Debian 13:
$ uname -r
6.12.88+deb13-amd64
$ snap debug sandbox-features|grep confinement
confinement-options: classic devmode
$ snap debug confinement
partial
$ aa-enabled
Yes
Ubuntu (24.04):
$ uname -r
6.8.0-117-generic
$ snap debug sandbox-features|grep confinement
confinement-options: classic devmode strict
$ snap debug confinement
strict
$ aa-enabled
Yes
What does this mean, you ask? Well, basically every Snap package you thought was running isolated in it’s own little sandbox were running unconfined the whole time. The prorpietary app you removed the :home connection from, so it wouldn’t be able to access your home directory? Well, it could have exfiltrated all our private files in the meantime.
How is this not a bigger deal and how are Snaps ever to become mainstream when even today, more than 10 years after the introduction of snaps, you can’t run them sandboxed on a huge portion of Linux distros?
have you actually looked at a snap’s status?
root@cave:~# lsb_release -d Description: Debian GNU/Linux 13 (trixie) root@cave:~# uname -r 6.12.88+deb13-amd64 root@cave:~# snap debug sandbox-features|grep confinement confinement-options: classic devmode root@cave:~# snap debug confinement partial root@cave:~# aa-enabled Yes root@cave:~# snap info --verbose hello-world name: hello-world summary: The 'hello-world' of snaps health: status: unknown message: health has not been set publisher: Canonical✓ contact: snaps@canonical.com links: contact: - mailto:snaps@canonical.com license: unset description: | This is a simple hello world example. commands: - hello-world.env - hello-world.evil - hello-world - hello-world.sh notes: private: false confinement: strict devmode: false jailmode: false trymode: false enabled: true broken: false ignore-validation: false snap-id: buPKUD3TKqCOgLEjjHx5kSiCpIs5cMuQ tracking: latest/stable refresh-date: today at 07:43 CDT installed: 6.4 (29) 20.5kB - root@cave:~# snap run hello-world.evil Hello Evil World! This example demonstrates the app confinement You should see a permission denied error next /snap/hello-world/29/bin/evil: 9: /snap/hello-world/29/bin/evil: cannot create /var/tmp/myevil.txt: Permission denied root@cave:~#I tried running chromium, removing :home and was still able save and open webpages in ~/test.html. However, this happened through the native file picker dialog.