Score:0

Ubuntu

Give a snap access to a specific folder in home directory, but not to the full home directory

Zorglub29

5/2/24, 5:13 PM

I would like to allow a snap to access / read / write to a given folder $HOME/some_folder/*, without giving it access to my full $HOME/* (since access to $HOME/some_folder is enough for this snap to do its work, and I would like to "isolate" things as much as possible / give as little access to my system as possible as a precaution, so no reason to give it access to my full $HOME/*).

Is there a way to do so? After reading a bit online, it feels like the "good" way to do so would be to deny this snap access to the home interface, but somehow set up a new (more restricted) interface to $HOME/some_folder to which this snap can be granted access. Is this doable and how?

I am on Ubuntu 22.04, though this should not play any major role I think.

Edit 1

This is for running an externally provided snap on my personal machine - I was not aware initially this information was important. So this means that the AppArmor suggested in the answer is the way to go then :) .

158

1 + 11

restricted-access

snap

22.04

popey

5/2/24, 6:29 PM

Is this a theoretical example for a snap you own and publish, or an example of a snap that someone else owns and has already published?

Zorglub29

5/2/24, 6:57 PM

It would be for a snap someone else would have already published - discussing with some third party the advantages of using snaps, and this isolation is one of the advantages we were discussing, so being able to check if this kind of isolation is doable would help convince the other actor to release as snap too :) .

Zorglub29

5/2/24, 6:58 PM

Curious: I am fine with the downvote, anybody who could explain why this question is downvoted? Is it stupid / did I miss something / do I fundamentally misunderstand something?

popey

5/2/24, 7:26 PM

Some people religiously downvote anything that doesn't have an Ubuntu release version number in it.

popey

5/2/24, 7:28 PM

Anything is of course possible, given you have apparmor which can limit the folders a snap can "see". But that only "fixes" it for the one user, not globally in the store. The problem will be when the snap is updated from the store, and it wipes out whatever apparmor changes you made locally. Snap isn't designed to be more granular really. It can, however be coerced with options like `system-files` and `personal-files` but those require the publisher to do more work.

Zorglub29

5/2/24, 7:36 PM

Thanks for the explanations. I think that as a user, it would be enough for me to be able to restrict it "myself, on my local machine", and maybe name this is possible to do in the installation manual. Then what you mean is that I should look into / set up a specific apparmor profile if I understand correctly?

Thomas Ward

5/2/24, 7:44 PM

@popey `home` is a less privileged connector than `personal-files` and `system-files` so if OP only wants access to `$HOME`` they can use a home connector but then roll local AppArmor restrictions as you said (and that I said in my answer)

popey

5/2/24, 11:13 PM

@ThomasWard I disagree. `personal-files` is narrower than `home`. `home` gives access to all non-hidden files. `personal-files` can give access to one specific directory within home. Or indeed one specific file within one specific directory.

Thomas Ward

5/3/24, 2:13 PM

@popey Given that anything using a super privileged interface requires approval on the app store (see https://snapcraft.io/docs/super-privileged-interfaces) if OP is requiring that they won't be able to use the snapstore to distribute without **special permissions**. Whereas oddly enough `home` doesn't seem to require that scrutiny.

popey

5/3/24, 2:18 PM

@ThomasWard I know, I alluded to that by saying "by those require the publisher to do more work". It's not odd, that `home` allows access to home without hidden files, the `personal-files` requires review because it could be used to access hidden files like `.ssh` or `.gnupg`.

Thomas Ward

5/3/24, 2:21 PM

@popey Ah, got it, i think i was looking for more clear definitions of the complexities ;) Updated my answer

Score:3

Ubuntu

Thomas Ward

5/2/24, 7:42 PM

Currently, there is no mechanism in Snapcraft plugs that allows this at the "snap on the snap store level"

Right now, Snapcraft only permits the home level connector at the narrowest for access to $HOME.

Per https://snapcraft.io/docs/home-interface which explains this connector:

The home interface allows access to non-hidden files owned by the user in the user’s home ($HOME) directory where a user normally stores their personal files and documents. The majority of snaps use strict confinement and do not have arbitrary access a system’s resources, including file and directories in the /home directory. Without this access, home will not be visible in file requesters, or as a destination from within the snap application.

This is the most narrow access to the $HOME directory that Snaps allow, based on looking through the list of supported connectors. You might be able to achieve stricter confinement with AppArmor profiles specific to your one snap on each endpoint system that has the snap installed, but out of the box in Snaps, no, there's no way to be more narrow with the permitted connectors' access other than what's built into the snapcraft interfaces.

popey is correct in comments that personal-files can be narrower than home interface because you can give specific read/write privileges (see https://snapcraft.io/docs/personal-files-interface) but because this is a Super-privileged interface, any snap distributing personal-files requires special permission and approval from the Store before they can be distributed and installed.

If your goal is to distribute this snap on the store, and you want to go the narrower personal-files interface route, expect there to be enhanced scrutiny and you needing to contact the Snapcraft store managers for special approval for this if your intention is to define these items in personal-files interface plugs. If your intention is to do this, expect to have to go through enhanced scrutiny in your snap first before you can distribute via the snap store.

+ 1

Zorglub29

5/3/24, 5:01 PM

Many thanks for your detailed answer. I now understand that my question was not specific enough - I will update it, I did not know of these different options hence did not know I was vague initially: an unknown unknown :) . My user case is for my own machine and limiting a snap to a smaller area than $HOME on my machine, so that would mean AppArmor if I understand correctly.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Give a snap access to a specific folder in home directory, but not to the full home directory

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.