Snap
Snap 是一个软件部署和包管理系统。这些包被称为“Snap 软件包”(“snaps”),可以通过“snapd”来管理“Snap 软件包”。它适用于一系列 Linux 发行版,因此允许与发行版无关的上游软件开发。Snap 的开发商 Canonical 管理 Snap Store 服务。用户可以通过该服务安装 Snap 软件包。
snapd 是一个用于管理 Snap 软件包的 REST API 守护进程。用户可以通过使用 snap 客户端与它进行交互,该客户端是 snapd 包的一部分。
用户可以使用 AppArmor 限制 Snap 软件包。现在内核中默认启用了该功能。请查阅相关维基页面,了解在系统中启用 AppArmor 的步骤。
- 如果您的系统中未启用AppArmor,则所有快照都将以 devel 模式运行,这意味着它们将与从Arch Linux存储库安装的应用程序一样,可以不受限制地访问您的系统。
- 运行不受信任的代码永远是不安全的,沙盒也无法改变这一点。
安装[编辑 | 编辑源代码]
安装 snapdAUR 包组。
snapd
在 /etc/profile.d/snapd.sh
中安装了一个脚本,记录了snapd软件包和桌面软件的二进制安装文件路径。重启后才会使改变生效。如果你在你的系统中启用了 AppArmor,snapd 是支持这种安全模型的,请根据 AppArmor#Installation 进行安装。
如果你在使用 AppArmor,请确保启用并打开了apparmor.service
和snapd.apparmor.service
服务。
配置[编辑 | 编辑源代码]
请启用/开启snapd.socket
服务以使snapd
守护线程正常运行,这样才能正常使用snap 。
使用[编辑 | 编辑源代码]
The snap tool is used to manage the snaps.
snap 工具被用来管理snaps。
查找软件包[编辑 | 编辑源代码]
用下面的命令可以在Ubuntu Store中查询你想要安装的snap软件包:
$ snap find searchterm
安装软件包[编辑 | 编辑源代码]
一但你找到想要安装的snap了,用下面的命令去安装它:
# snap install snapname
这将需要root权限。目前还不能为每个用户安装snap。为了使其可以被系统使用,snap会把下载的内容放到/var/lib/snapd/snaps
目路并挂载到/var/lib/snapd/snap/snapname
。
It will also create mount units for each snap and add them to /etc/systemd/system/multi-user.target.wants/
as symlinks to make all snaps available when the system is booted.
Once that is done you should find it in the list of installed snaps together with its version number, revision and developer using:
$ snap list
You can also sideload snaps from your local hard drive with:
# snap install --dangerous /path/to/snap
Updating[编辑 | 编辑源代码]
To update your snaps manually use:
# snap refresh
Snaps are refreshed automatically according to snap refresh.timer
setting.
To view the next/last refresh times use:
# snap refresh --time
To set a different refresh time, eg. twice a day:
# snap set core refresh.timer=0:00~24:00/2
See system options documentation page for details on customizing the refresh time.
移除软件包[编辑 | 编辑源代码]
Snaps can be removed by executing:
# snap remove snapname
提示与技巧[编辑 | 编辑源代码]
Classic snaps[编辑 | 编辑源代码]
Some snaps (e.g. Julia and Pycharm) use classic confinement. However, classic confinement requires the /snap
directory, which is not FHS-compliant. The snapd package does not ship this directory, however the user can manually create a symbolic link between /var/lib/snapd/snap
and /snap
to allow the installation of classic snaps:
# ln -s /var/lib/snapd/snap /snap
Confinement[编辑 | 编辑源代码]
When using AppArmor, snapd will generate the same profiles for snaps as on Ubuntu. The AppArmor parser is smart enough to drop the rules that are not yet supported by the mainline kernel.
To verify that basic confinement is working, install hello-world snap. Then run the following:
$ hello-world.evil
Hello Evil World! This example demonstrates the app confinement You should see a permission denied error next /snap/hello-world/27/bin/evil: 9: /snap/hello-world/27/bin/evil: cannot create /var/tmp/myevil.txt: Permission denied
The denial was caused by AppArmor and should have been logged:
# dmesg
... [ +0.000003] audit: type=1327 audit(1540469583.966:257): proctitle=2F62696E2F7368002F736E61702F68656C6C6F2D776F726C642F32372F62696E2F6576696C [ +12.268939] audit: type=1400 audit(1540469596.236:258): apparmor="DENIED" operation="open" profile="snap.hello-world.evil" name="/var/tmp/myevil.txt" pid=10835 comm="evil" requested_mask="wc" denied_mask="wc" fsuid=1000 ouid=1000 [ +0.000006] audit: type=1300 audit(1540469596.236:258): arch=c000003e syscall=2 success=no exit=-13 a0=55d991ba6bc8 a1=241 a2=1b6 a3=55d991ba6be0 items=0 ppid=31349 pid=10835 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts2 ses=3 comm="evil" exe="/bin/dash" subj==snap.hello-world.evil (enforce) ...
If you do not see the denial, verify that the profiles were loaded:
# aa-status | grep snap.hello-world
snap.hello-world.env snap.hello-world.evil snap.hello-world.hello-world snap.hello-world.sh
Also, you can check what sandbox features are available in the system according to snapd:
$ snap debug sandbox-features
apparmor: kernel:caps kernel:domain kernel:file kernel:mount kernel:namespaces kernel:network_v8 kernel:policy kernel:ptrace kernel:query kernel:rlimit kernel:signal parser:unsafe policy:default support-level:partial confinement-options: devmode dbus: mediated-bus-access kmod: mediated-modprobe mount: freezer-cgroup-v1 layouts mount-namespace per-snap-persistency per-snap-profiles per-snap-updates per-snap-user-profiles stale-base-invalidation seccomp: bpf-argument-filtering kernel:allow kernel:errno kernel:kill_process kernel:kill_thread kernel:log kernel:trace kernel:trap
Hide the snap folder[编辑 | 编辑源代码]
See XDG Base Directory#Hiding unwanted directories to hide the snap
folder.
Sudo[编辑 | 编辑源代码]
With secure_path
being enabled in sudo by default, the /var/lib/snapd/snap/bin
directory is no longer present in the default $PATH
environment variable of the process started by sudo. Commands such as sudo lxc list
will fail, as the lxc
symbolic link can no longer be found by the shell process.
This can be addressed on per user basis by adding the following snippet to /etc/sudoers.d/90_snap
:
# Add snap binaries installation dir to PATH Defaults:<your-user-name> secure_path="/usr/local/sbin:/usr/local/bin:/usr/bin:/var/lib/snapd/snap/bin"
Where <your-user-name>
must be replaced with the desired $USER
.
Troubleshooting[编辑 | 编辑源代码]
Text unreadable[编辑 | 编辑源代码]
If you are seeing squares instead of readable characters, you need to clear the font cache:
# rm -f /var/cache/fontconfig/* $ rm -f ~/.cache/fontconfig/* # fc-cache -r -v
Snapctl also stores internal caches for each individual snap, which need to be cleared seperately. First, find them by running:
$ find ~/snap/ -wholename '*/.cache/fontconfig'
... /home/darth_vader/snap/mailspring/common/.cache/fontconfig ... /home/darth_vader/snap/authy/common/.cache/fontconfig ... /home/darth_vader/snap/icedrive/common/.cache/fontconfig ... /home/darth_vader/snap/discord/common/.cache/fontconfig ... /home/darth_vader/snap/bitwarden/common/.cache/fontconfig
Then either remove them individually or use this simple loop.
Finally, Restart your session.
Error: cannot mount squashfs[编辑 | 编辑源代码]
Snap packages use the SquashFS file system. In the event of an error similar to the following:
error: system does not fully support snapd: cannot mount squashfs image using "squashfs"
you may verify that the SquashFS kernel module is loaded with
$ lsmod
Module Size Used by squashfs xxxxx x ...
Error: /user.slice/user-1000.slice/session-1.scope is not a snap cgroup[编辑 | 编辑源代码]
You need to set your DBUS_SESSION_BUS_ADDRESS environment variable like so:
export DBUS_SESSION_BUS_ADDRESS="unix:path=$XDG_RUNTIME_DIR/bus"
To make this change permanent and also available in your GUI session, consider adding this line to your ~/.xprofile file.
For more information and full discussion about this issue, please read here
Graphical management[编辑 | 编辑源代码]
Both Gnome Software Center and KDE Discover can provide native snap support. For KDE Discover install discover-snapAUR package.
The Snap Store can be installed via snap
# snap install snap-store
Support[编辑 | 编辑源代码]
Arch Linux related mailing lists and other official Arch Linux support channels are not an appropriate place to request help with snaps on Arch Linux. An appropriate place to ask for support is the Snapcraft forum.
See also[编辑 | 编辑源代码]
- Official site
- GitHub repository
- ArsTechnica article (2016-06) about Ubuntu snaps becoming available for Arch and other distributions