Alex, one challenge I found while implementing the solution is that we don't know ahead of time that /usr needs to be created because we don't know the contents base snap of the snap that we are configuring at the time.
The only solution I have right now is to unconditionally weaken the sandbox for s-u-n as explained above when the specific interface system-packages-doc is connected.
I'm not done looking, just posting an update of the current state.
Alex, one challenge I found while implementing the solution is that we don't know ahead of time that /usr needs to be created because we don't know the contents base snap of the snap that we are configuring at the time.
The only solution I have right now is to unconditionally weaken the sandbox for s-u-n as explained above when the specific interface system-packages-doc is connected.
I'm not done looking, just posting an update of the current state.