Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

None, but that’s the point/ feature of classic confinement snaps : they have access to the entire filesystem at the expense of having access to the entire filesystem :)

By comparison, a strictly confined snap only has access to its own data directory and possibly to some configuration files or the users home directory, depending on which permissions it’s been granted.

A text editor which is most useful if it can edit arbitrary files in the filesystem could be classically confined.

A music player might be strictly confined with access only to external devices (and maybe users home directory).

A fishy untrustworthy crypto miner could be strictly confined with no additional permissions so it can only see/touch its own data.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: