--- title: A guide to snap permissions and interfaces description: Snap is a Linux application package management system which allow developers to easily publish self contained software packages (snaps) that work across many distributions and versions of Linux. Snaps have security at their heart, and are designed to ensure all applications support the principle of least privilege / authority. That is, ea […] url: https://canonical.com/blog/a-guide-to-snap-permissions-and-interfaces?format=md --- 1. [Blog](https://canonical.com/blog) 2. Article --- [Alex Murray](https://canonical.com/blog/author/alexmurray "More about Alex Murray") 1 November 2018 # A guide to snap permissions and interfaces [Security](https://canonical.com/blog/tag/security) [Snap](https://canonical.com/blog/tag/snap) [snapcraft](https://canonical.com/blog/tag/snapcraft) [Ubuntu](https://canonical.com/blog/tag/ubuntu) --- Share the article Snap is a Linux application package management system which allow developers to easily publish self contained software packages (snaps) that work across many distributions and versions of Linux. Snaps have security at their heart, and are designed to ensure all applications support the principle of least privilege / authority. That is, each package only has access to the common groups of resources that it requires to perform its intended function. To support this, each package is *sandboxed* so that it runs in a constrained environment, isolated from the rest of the system – this is achieved via a combination of [AppArmor, seccomp, mount namespaces, cgroups and traditional UNIX permissions](https://docs.ubuntu.com/core/en/guides/intro/security). To then allow a package access to common resources, the snap system provides ‘interfaces’ to which packages can be granted access as required or determined by the user. This includes things like files within the user’s home directory, or files on removable media, as well as hardware devices such as webcams or audio devices (for a full list of interfaces see the [snap documentation](https://docs.snapcraft.io/supported-interfaces)). Interfaces can also be provided from one snap to another, for example to let one snap provide services via DBus to another snap application, or to provide shared content from one snap to another. Access to a given interface corresponds to a particular permission for a snap package. ## **Interface Connections** A snap interface is provided by a *slot* declared by a given snap package (the core snap itself provides many slots), whilst other snaps consume a given interface by declaring themselves as a *plug* for that interface. Each snap declares the interfaces it requires (ie. by listing these as  plugs) and are then connected to the corresponding slot by the snapd daemon either automatically, or manually, depending on the interface. Some interfaces are connected automatically to all snaps that declare a plug to them, as they present a low risk or the interface is generally useful to most snaps (such as the *desktop* and *network* interfaces). Other interfaces (such as the *removable-media* or *cups-control* interfaces) must either be connected manually by the user, are auto-connected via a specially granted exception from the Snap Store or are auto-connected by a custom device-specific gadget snap. Snap Store reviewers typically only grant exceptions when it is deemed the utility of the application will be greatly diminished if the requested interfaces are not connected automatically. The interfaces used by a snap can be shown in two ways, either graphically through the *Software* application or via the command-line. For each installed snap, a *Permissions* button is shown in *Software* that lists the interfaces the snap declares plugs to, and allows the user to manually connect or disconnect each interface as desired. The same information is also exposed via the command-line via the *snap interfaces* command. ``` $ snap interfaces gimp Slot             Plug :home            gimp,gnome-characters,gnome-logs -                gimp:cups-control -                gimp:removable-media (...) ``` In this case, as the *cups-control* and *removable-media* interfaces are not connected for the gimp snap, there is no corresponding slot listed. When connecting an interface, the user is prompted to authenticate as an administrator to ensure interface connections cannot be made by users without appropriate permission and ensuring the user is always in control of the permissions for each snap application. I hope this post gets you thinking about how snaps could work for you.  As we have seen, interfaces provide a means for snap applications to share and access common resources, whilst respecting the principle of least privilege and providing the user ultimate control over the permissions of a given application.  If you are interested in learning more about using snaps, please visit . [Get in touch Interested in running Ubuntu in your organization?](https://ubuntu.com/about/contact-us/form) ## Sign up for our newsletter Get the latest Canonical news and updates in your inbox. Work email: \*I agree to receive information about Canonical's products and services. By submitting this form, I confirm that I have read and agree to [Canonical's Privacy Policy](https://canonical.com/legal/dataprivacy). Sign up ## Share on --- ## Related posts [### Canonical joins the Open Secure AI Alliance](https://canonical.com/blog/open-secure-ai-alliance) Canonical is now part of the Open Secure AI Alliance, announced by NVIDIA with partners across cloud computing, cybersecurity, enterprise software, open source foundations, and... [Canonical](https://canonical.com/blog/author/canonical) 28 August 2026 [### Arduino® VENTUNO™ Q is available for pre-order with Ubuntu pre-installed](https://canonical.com/blog/arduino-ventuno-q-is-available-for-pre-order-with-ubuntu-pre-installed) London, UK – August 25, 2026 – Following our initial collaboration announcement in March 2026, Canonical and Arduino (a subsidiary of Qualcomm Technologies, Inc.) are excited... [Canonical](https://canonical.com/blog/author/canonical) 25 August 2026 [### Januscape vulnerability CVE-2026-53359 mitigations available](https://canonical.com/blog/januscape-linux-vulnerability-mitigations-available) Introduction A local privilege escalation (LPE) vulnerability affecting the Linux kernel was publicly disclosed on July 6, 2026. The vulnerability was assigned CVE ID... [seth-arnold](https://canonical.com/blog/author/seth-arnold) 11 July 2026 [### DirtyClone Linux kernel local privilege escalation vulnerability fixes available](https://canonical.com/blog/dirtyclone-linux-vulnerability-fixes-available) On June 25, 2026, JFrog published their research into CVE-2026-43503, referring to the vulnerability as DirtyClone. The vulnerability had previously been responsibly disclosed... [Luci Stanescu](https://canonical.com/blog/author/lucistanescu) 1 July 2026