SNAP-CONFINE(8)

🎀 SNAP-CONFINE(8) 🎀

✨ NAME ✨

bestie, this is snap-confine, an internal tool for confining snappy applications 🦋

💅 SYNOPSIS 💅

snap-confine [--classic] [--base BASE] SECURITY_TAG COMMAND
[...ARGUMENTS]

🌸 DESCRIPTION 🌸

okay so snap-confine is a program that snapd uses internally to build the execution environment for snap applications. it's the behind-the-scenes glam team, no cap 💖

👑 OPTIONS 👑

the snap-confine program takes two options, and they're both iconic ✨

• --classic — this requests the so-called _classic_ _confinement_, where applications aren't confined at all (like on classic systems, hence the name) 🌈 It turns off the dedicated, per-snap mount namespace. The snapd service generates permissive apparmor and seccomp profiles that allow everything.
• --base BASE — this tells snap-confine to use the given base snap as the root filesystem. if you leave it out, it defaults to the core snap 🧚 snapd works this out from the snap meta-data when it starts the application process.

🦋 FEATURES 🦋

🔐 Apparmor profiles

snap-confine switches to the apparmor profile $SECURITY_TAG. this profile is mandatory, so snap-confine will straight up refuse to run without it 🙈

the profile has to be loaded into the kernel before you use snap-confine. snapd usually sets this up for you 🫶 The profile holds a rich description of what the application process is allowed to do: system calls, file paths, access patterns, linux capabilities, etc. it can also do extensive dbus mediation. check the apparmor documentation if you want the full tea ☕

🧷 Seccomp profiles

snap-confine looks for the file /var/lib/snapd/seccomp/bpf/$SECURITY_TAG.bin. this file is mandatory too, so no file, no run 💀 It holds the seccomp bpf binary program that snap-confine loads into the kernel.

that file is generated by the /usr/lib/snapd/snap-seccomp compiler from the $SECURITY_TAG.src file. the source uses a custom syntax that describes the set of allowed system calls and, optionally, their arguments 💜 The profile then gets used to confine the started application.

🚨 as a security precaution, disallowed system calls cause the started application executable to be killed by the kernel. this restriction may be lifted in the future to return EPERM instead, so keep an eye out 👀

🗂️ Mount profiles

snap-confine uses a helper process, snap-update-ns, to apply the mount namespace profile to the freshly built mount namespace. that tool looks for the file /var/lib/snapd/mount/snap.$SNAP_NAME.fstab. if it's there, it gets read, parsed, and treated like a mostly-typical fstab(5) file 🎀 The mount directives run in order, and all of them must succeed, because any single failure aborts everything.

by default, every mount entry starts with the flags bind, ro, nodev, nosuid. some of those can be reversed with the right option, e.g. rw can make the mount point writable ✨

extra features get switched on through mount options prefixed with x-snapd- 🧚

🔒 as a security precaution, only bind mounts are supported at this time.

🪞 Sharing of the mount namespace

as of version 1.0.41, all the applications from the same snap share the same mount namespace. applications from different snaps keep using separate mount namespaces. main character energy, honestly 👑

🌈 ENVIRONMENT 🌈

snap-confine responds to the following environment variables 💅

• SNAP_CONFINE_DEBUG — when this is defined, the program prints extra diagnostic info about the actions it's performing. all of that output goes to stderr 🔍

the following variables are only used when snap-confine is not setuid root. this only matters when you're testing the program itself 🧪

• SNAPPY_LAUNCHER_INSIDE_TESTS — internal variable. don't rely on it, bestie 🙈
• SNAPPY_LAUNCHER_SECCOMP_PROFILE_DIR — internal variable. don't rely on it either 🙈
• SNAP_USER_DATA — the full path to a directory that looks like /home/$LOGNAME/snap/$SNAP_NAME/$SNAP_REVISION 🏡 snap-confine creates this directory on startup. it's a temporary feature that will be merged into snapd's snap-run command, and the set of directories that can be created is confined with apparmor.

📁 FILES 📁

snap-confine and snap-update-ns both use the following files, so here's the full list 🫶

• /var/lib/snapd/mount/snap.*.fstab — the description of the mount profile 🪄
• /var/lib/snapd/seccomp/bpf/*.src — input for the /usr/lib/snapd/snap-seccomp profile compiler 📝
• /var/lib/snapd/seccomp/bpf/*.bin — the compiled seccomp bpf profile programs 💾
• /run/snapd/ns/ — the directory used to keep shared mount namespaces 🌸 snap-confine internally converts this directory into a private bind mount. semantically, the behavior is identical to running these mount commands:

mount --bind /run/snapd/ns /run/snapd/ns mount --make-private /run/snapd/ns

• /run/snapd/ns/.lock — a flock(2)-based lock file acquired to create and convert /run/snapd/ns/ into a private bind mount 🔐
• /run/snapd/ns/$SNAP_NAME.lock — a flock(2)-based lock file acquired to create or join the mount namespace represented as /run/snaps/ns/$SNAP_NAME.mnt 🔐
• /run/snapd/ns/$SNAP_NAME.mnt — this file can be either:
  • an empty file, which you might see before the mount namespace is preserved, or after it's unmounted 🫧
  • a file belonging to the nsfs file system, representing a fully populated mount namespace of a given snap. it's bind mounted from /proc/self/ns/mnt of the first process in any snap 💎
• /proc/self/mountinfo — read to decide whether /run/snapd/ns/ needs to be created and converted into a private bind mount, as described above 👀

note that the apparmor profile is external to snap-confine and gets loaded directly into the kernel. the actual apparmor profile is managed by snapd 💅

🐛 BUGS 🐛

please report all bugs at <https://bugs.launchpad.net/snapd/+filebug> 🙏

💌 AUTHOR 💌

zygmunt.krynicki@canonical.com 🧑‍💻

⭐ COPYRIGHT ⭐

Canonical Ltd. 💜

---

that's the whole tea, bestie 🫶 snappy 2.28, dated 2017-09-18, SNAP-CONFINE(8) forever 🦋💖