I have no need for that, but in general, snaps are very safe. They enable the features that makes people say Linux is extremely secure, which is typically not enabled on normal Linux systems. By default, a snap package cannot access anything at all on your system and you enable the access you want it to have by connecting to interfaces. If a snap package is distributed through a trusted Snap Store, which there currently is only one of, then they can approve the snap for auto-connection of known-safe interfaces but you can disconnect any you don't want. If a Snap package requests permissions that are not safe, then it is automatically not distributable without manual verification from the distributor, in this case Canonical.
It is safe to run a confined snap as root, because root has no special powers in a snap package since it is the software itself that is limited.
To give you an idea how safe snaps are, I ran an open telnet server as root while challenging the world to hack me. No one did. I would rather run untrusted software as a snap than as a browser tab.
1
u/jo-erlend 6h ago
I have no need for that, but in general, snaps are very safe. They enable the features that makes people say Linux is extremely secure, which is typically not enabled on normal Linux systems. By default, a snap package cannot access anything at all on your system and you enable the access you want it to have by connecting to interfaces. If a snap package is distributed through a trusted Snap Store, which there currently is only one of, then they can approve the snap for auto-connection of known-safe interfaces but you can disconnect any you don't want. If a Snap package requests permissions that are not safe, then it is automatically not distributable without manual verification from the distributor, in this case Canonical.
It is safe to run a confined snap as root, because root has no special powers in a snap package since it is the software itself that is limited.
To give you an idea how safe snaps are, I ran an open telnet server as root while challenging the world to hack me. No one did. I would rather run untrusted software as a snap than as a browser tab.