Comment 3 for bug 1846496

strace while no snaps are open shows frequent messages being read from fd 4:

$ sudo strace -ffp $(pidof snapd)
[pid 5860] futex(0x55d25953e338, FUTEX_WAIT_PRIVATE, 0, {tv_sec=34, tv_nsec=89621} <unfinished ...>
[pid 5899] <... select resumed>) = 1 (in [4])
[pid 5899] futex(0x55d25953e338, FUTEX_WAKE_PRIVATE, 1) = 1
[pid 5899] recvfrom(4, <unfinished ...>
[pid 5860] <... futex resumed>) = 0
[pid 5899] <... recvfrom resumed>[{prefix="libudev", magic=htonl(0xfeedcafe), header_size=40, properties_off=40, properties_len=370, filter_subsystem_hash=htonl(0xc370b302), filter_devtype_hash=htonl(0), filter_tag_bloom_hi=htonl(0x2080400), filter_tag_bloom_lo=htonl(0x10c00001)}, "ACTION=change\0DEVPATH=/devices/p"...], 4096, MSG_PEEK, {sa_family=AF_NETLINK, nl_pid=429, nl_groups=0x000002}, [112 => 12]) = 410
[pid 5860] nanosleep({tv_sec=0, tv_nsec=20000}, <unfinished ...>
[pid 5899] recvfrom(4, [{prefix="libudev", magic=htonl(0xfeedcafe), header_size=40, properties_off=40, properties_len=370, filter_subsystem_hash=htonl(0xc370b302), filter_devtype_hash=htonl(0), filter_tag_bloom_hi=htonl(0x2080400), filter_tag_bloom_lo=htonl(0x10c00001)}, "ACTION=change\0DEVPATH=/devices/p"...], 4096, 0, {sa_family=AF_NETLINK, nl_pid=429, nl_groups=0x000002}, [112 => 12]) = 410
[pid 5860] <... nanosleep resumed>NULL) = 0
[pid 5899] fcntl(10, F_GETFL) = 0 (flags O_RDONLY)
[pid 5899] fcntl(10, F_SETFL, O_RDONLY) = 0
[pid 5899] select(11, [4 10], NULL, NULL, NULL <unfinished ...>
[pid 5860] nanosleep({tv_sec=0, tv_nsec=20000}, NULL) = 0
[pid 5860] futex(0x55d25953e338, FUTEX_WAIT_PRIVATE, 0, {tv_sec=25, tv_nsec=990469943}

(and similar, repeating)

File descriptor 4 corresponds to a kernel netlink socket:

$ lsof -p $(pidof snapd)
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
...
snapd 5859 root 4u netlink 0t0 68137 KOBJECT_UEVENT