Snap installed as devmode can end up running confined

[Pat McGowan]

Splitting this off from lp:1667385

I installed in snap in devmode (webdemo) on arm64 to work around lp:1667480. Also note that the snap is published by me and the content interface it plugs is canonical, which seems like its fine.

I noticed after certain sequence of connect/disconnect/enable/disable commandw the snap was no longer in devmode and started reporting apparmor denials which prevented it from running. For example:

snap disable webdemo
snap enable webdemo (app is running)
snap disconnect webdemo:platform
snap connect webdemo:platform ubuntu-app-platform:platform
snap disable webdemo
snap enable webdemo (app fails with DENIALs)

The app installs a daemon that opens a browser view on localhost, where another control daemon provides content.

[Pat McGowan (pat-mcgowan)]

From the duplicate
To reproduce this issue.
1. Fetch the source code from here
    http://bazaar.launchpad.net/~gary-wzl77/+junk/test-hooks/files
2. snap the project
    snapcraft && sudo snap install --devmode hooks_0.1_amd64.snap
3. run the following command
   sudo hooks.test
5. goto ${SNAP_DATA}/hooks/current to check new folder's owner(It's an expected result)
   drwxr-xr-x 2 daemon daemon 4096 3月 9 15:39 new_folder
6. disalbe and enable the snap
   sudo snap disable hooks && sudo snap enable hooks
7. run the test command again
   /snap/hooks/x1/bin/test: 11: /snap/hooks/x1/bin/test: chown: Permission denied

chown syscall is allowed in devmode but forbidden in strict confinement mode at this moment due to the bug.
https://bugs.launchpad.net/ubuntu/+source/snapd/+bug/1581310

So from the above step, devmode capability is dropped after running snap enable/disable and the snap has become a strict confinement snap.