How Snap Confinement Works

Project Discussion
1

More info is needed here ie:

sudo aa-status | grep gimp && apt policy snap
   /app/bin/gimp-2.10 (6100) flatpak
   /app/lib/gimp/2.0/plug-ins/script-fu/script-fu (6169) flatpak
snap:
  Installed: (none)
  Candidate: 2013-11-29-11
  Version table:
     2013-11-29-11 500
        500 http://archive.ubuntu.com/ubuntu noble/universe amd64 Packages


apt policy snapd
snapd:
  Installed: (none)
  Candidate: (none)
  Version table:
     2.66.1+24.04 -10
        500 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 Packages
     2.63+24.04ubuntu0.1 -10
        500 http://security.ubuntu.com/ubuntu noble-security/main amd64 Packages
     2.62+24.04build1 -10
        500 http://archive.ubuntu.com/ubuntu noble/main amd64 Packages

Please explain. Snap confinements IMHO are not Ideal.

2

Well, first of all the snap .deb is a DNA sequencer app (see apt show snap), not sure that is what you wanted to check :wink: The tool that brings along the snap command is actually snapd and while there is a deb of it, the actual payload comes from the snapd snap package here (snap list should show you a snapd package installed as a snap) …

That there are nowadays flatpak apparmor profiles is a system level change to harden the install made by the ubuntu security team, flatpak itself does not actually utilize apparmor for its confinement … if you want to read more:

and here:

https://www.omgubuntu.co.uk/2024/07/ubuntu-apparmor-fix-for-telegram-flatpak

snap confinement utilizes apparmor, seccomp, namespaces and cgroups and udev tagging to build its secure sandbox the applications are run in …

Any type of confinement comes with drawbacks, that’s an undeniable fact and both systems (snap as well as flatpak) have to battle with this one way or the other.

Regarding the file access that was the original topic triggering this discussion, apparmor simply operates on a lower level than the filesystem, but things like symlinks are a filesystem feature (i.e. a (v)fat has no ability or concept of links at all, ext4 has them, other filesystems might handle them differently than ext4 etc etc) to allow apparmor to handle something like a symlink it would have to integrate with a higher layer and would have to loop into the respective filesystem implementation but that would very likely come with performance penalties which the current snap sandboxing needs to avoid at any cost (snaps are commercially used in system critical spaces in production in industrial, medical, robotics, automotive and realtime setups where any performance impact due to sandboxing would be fatal).

Theoretically you can package snap apps using XDG portals, that would allow your app to overcome this limitation by copying the files around underneath in a transparent way, but it is

  • a) up to the packager to decide if they want to use this and
  • b) portals also have their limitations on other levels

Regarding apparmor snap profiles, they get generated on the fly by snapd when an application snap gets installed based on the set of interfaces a snap package has enabled, so you wont find any app specific profiles with aa-status unless you install a snap …

4 Likes
3

@ogra
As a non-technical user this was, for me, one of the most lucid explanations on this subject that I have read.
Thank you for your hard work!

2 Likes
4

Some new information that i was not aware of but most I knew.
@ogra Thank You for taking the time to inform me.

1 Like