Looking for the code? Look no further: https://github.com/larryprice/pingus-snap
In my last post, I demonstrated creating a snap package for an application available in the archive. I left that application unconfined, which is taboo in the long run if we want our system to be secure. In a few steps, we can add the necessary components to confine our pingus
snap.
For reference, this is the original snapcraft.yaml
file for creating a pingus
snap, except that we’ve updated the confinement
property to strict
:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 |
|
If you’re feeling bold, you can build and install the snap from here, but be warned that this led me into an ncurses nightmare that I had to forcibly kill. That’s largely because pingus
depends on X11, which is not available out-of-the-box once we’ve confined our snap. If we want to use X11, we’re going to need to connect to it using the snap-land concept of interfaces. Interfaces allow us to access shared resources and connections provided by the system or other snaps. There’s some terminology to grapple with here, but the bottom line is that a “slot” provides an interface which a “plug” connects to. You can see a big list of available interfaces with descriptions on the wiki. Our pingus
app will “plug” into the X11 interface’s “slot”:
1 2 3 4 5 6 |
|
You can build and install the new snap with the --dangerous
flag for your local confined snap. After that, you can verify the interface connection with the snap interfaces
command:
1 2 3 4 5 6 7 8 9 |
|
Now, when we run pingus
… it works! Well, video works. If you want sound, we’ll also need the pulseaudio
interface:
1 2 3 4 5 6 7 |
|
Once again: build, install, and run… et voilĂ ! Is it just me, or was that surprisingly painless? Of course, not all applications live such isolated lives. Make note that the x11 interface is supposed to be a transitional interface, meaning that we would rather our app fully transition to Mir or some alternative. To go a step further with this snap, we could create a snapcraft.yaml
to build from source to get the absolute latest version of our app. At this point, we can change our grade
property to stable
and feel good about something that we could push to the store for review.
Any code you see here is free software. Find the project here: https://github.com/larryprice/pingus-snap