Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> Snaps seem to work well where they work, but it's limited by their systemd dependency.

A more serious issue with snaps is that they rely on AppArmor as a security mechanism, which is not actually present on most Linux systems (only Ubuntu variants, SUSE and Solus). The snaps will still run elsewhere, but not with the same security as you might think you were getting.



will installing snapd not install AppArmor as well?


> will installing snapd not install AppArmor as well?

It can't, because AppArmor is a kernel-level feature that also requires some level of integration into the rest of the distribution. Red Hat/Fedora-based distributions already use SELinux in place of AppArmor, so using snap on those systems can't have full security capabilities (making SELinux and snap work together would be non-trivial, and I don't think anyone is motivated to do it).

Flatpak uses other mechanisms for limiting the access that applications have, so does not rely on either AppArmor or SELinux being on the host system.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: