[snap] Unable to access files owned by another user

[Andreas Fritiofson]

The chromium snap cannot access files in my $HOME that have a different owner, even though the files are world-readable.

[Olivier Tilloy (osomon)]

That's the intended behaviour, snapd's sandbox doesn't allow strictly confined snaps (such as chromium) to access files owned by someone else.

Out of curiosity, what's the use case for files owned by a different owner in your home directory?

[Andreas Fritiofson (andreas-fritiofson)]

In my case, a docker-based firmware build process produces a update package (owned by root, for some reason), which I upload to a target via a web-interface.

Sure, I can change the owner of the files but still, this used to work and it doesn't now.

Let me turn the question around. What is the use-case for prohibiting access to files in the user's home directory, which are readable by the user based on good old Unix filesystem permissions? Devising a completely parallel access policy based on arbitrary and invisible rules seems utterly stupid to me.

[Olivier Tilloy (osomon)]

That's a question that would be better answered by the snapd design/security team. May I suggest you ask it on https://forum.snapcraft.io/ (preferably keeping offending words out, this will help in getting answers and sparking a constructive conversation)?