As of snapd 2.20, snappy supports confinement: classic
which allows the snap to run without restrictions. Future releases of snapd will also support a classic interface (name TBD) that operates similarly. Snaps specifying classic confinement may target the stable channel, but are only supported on classic distro systems (ie, not on Ubuntu Core).
Because classic confinement snaps run without restrictions, use of classic confinement effectively grants device ownership to the snap. Due to the sensitive nature of classic confinement:
--classic
when using snap install
to install a snap using classic confinementconfinement: classic
and the upcoming classic
interface (final name TBD)Classic requests generally fall under a number of categories. Below lists categories that developers may consult for things that are known to be allowed/disallowed use of classic confinement. @reviewers may consult these lists when processing classic requests. If something falls outside of these lists, then the requirements must be gathered by a senior reviewer and discussed with an architect (after which, it can be added to the lists).
This lists some criteria that might require classic (non-exhaustive):
NOTE: while something may be known to require classic, that alone may not justify granting classic confinement.
Classic confinement sometimes might seem like the perfect solution to a publisher’s problem, but snaps that use confinement: classic
differ from strict mode snaps in important ways:
base
in the snap’s yaml.Because of ‘2’, great care must be taken for the snap to work reliably across all distributions since, for example, as part of the build process snapcraft will adjust the snap’s binaries through binary patching and/or setting environment variables to look into the $SNAP
directory for paths, either of which could affect the snap’s reliability when running on arbitrary cross-distribution host filesystems. In contrast, strict mode snaps use what is specified by base
in the snap’s yaml as the basis for its root filesystem at runtime and can depend on it not changing.
Sometimes it might make sense for a snap to be allowed the use of classic (eg, for classic distro) but be usable in strict mode (eg, for Ubuntu Core). In these cases, rather than having two separate snaps, it is considered best to have two separate tracks, the default track and another called classicmode
.
Last updated 10 months ago.