Ubuntu 24.10 To Enhance Snap Permissions Handling

[phoronix]

Phoronix: Ubuntu 24.10 To Enhance Snap Permissions Handling

With the upcoming Ubuntu 24.10 release, Canonical is introducing permission prompting for more control over Snap access to systems to enhance security...

https://www.phoronix.com/news/Ubuntu-24.10-Snap-Permissions

[geerge]

Canonical really improved my snap experience when they convinced me to switch to Fedora to avoid snaps.

[MadWatch]

Now if they could get rid of that annoying automatic update system then Snap might begin to be good.

[hyperchaotic]

Good, this is sorely needed for Snap and Flatpak.

[ahrs]

I have to admit, this does look slick. Snaps continued reliance on AppArmor is why Flatpak has already won though. I don't want to have to install a custom kernel with whatever AppArmor patches are needed, and make sure my AppArmor user-space is specially configured to work right.

I do have AppArmor enabled in my kernel and user-space on my Gentoo system but it's almost certainly not the right versions that Ubuntu uses (Gentoo's own release monitoring even says it's outdated: https://packages.gentoo.org/packages/sys-apps/apparmor)

It wouldn't run on my system anyway, where as Flatpak does, because Snap needs Systemd just to mount a squashfs file. I could perhaps use an LXC container as a workaround if I could figure out a) how to get GUI apps to run in it and b) how to get snapd to run in it (it doesn't seem straightforward to run in a container) but why bother when Flatpak works fine.

[tesfabpel]

Good, this is sorely needed for Snap and Flatpak.

Flatpak already has it. With Flatseal you can also manage it via a GUI app (without using the command line).

[moonwalker]

Our company actually develops a product based on Ubuntu, and Snap has been a major PITA for that. There are environments our product has to run in that don't have Internet access, yet still need to have regularly updated with any security fixes software, and Canonical has no solution for that right now other than selectively pulling specific packages from snap store and side-loading them into a standalone snap proxy instance. I've also heard Canonical claiming that shipping Firefox as a snap is Mozilla's requirement, but why does Mozilla then serve their own APT repo now? Either way, on my work laptop (where I run Ubuntu because our corp IT doesn't allow running Debian) I just have APT pin to set `snap` priority to -1, making sure it never gets installed once it is purged from the system.

[AkulaMD]

Glad to hear the news. As a linux user with a beginner level of proficiency, the thing i like about Snap as apposed to Flatpak is that it gives me extra 1 fps in OpenRA game (30fps vs 29fps) while running on my Raspberry Pi 5 4GB RAM version despite the noticably longer time taken to launch the game compared to Flatoack.

[royce]

Our company actually develops a product based on Ubuntu, and Snap has been a major PITA for that. There are environments our product has to run in that don't have Internet access, yet still need to have regularly updated with any security fixes software, and Canonical has no solution for that right now other than selectively pulling specific packages from snap store and side-loading them into a standalone snap proxy instance.

It seems like you should be using a different packaging mechanism than snap then.

[royce]

Glad to hear the news. As a linux user with a beginner level of proficiency, the thing i like about Snap as apposed to Flatpak is that it gives me extra 1 fps in OpenRA game (30fps vs 29fps) while running on my Raspberry Pi 5 4GB RAM version despite the noticably longer time taken to launch the game compared to Flatoack.

That's probably down to how the binaries were compiled for each flatpak and snap versions. Once they're running, there's basically zero overhead.