--- title: A guide to snap permissions and interfaces description: Snap is a Linux application package management system which allow developers to easily publish self contained software packages (snaps) that work across many distributions and versions of Linux. Snaps have security at their heart, and are designed to ensure all applications support the principle of least privilege / authority. That is, ea […] url: https://canonical.com/blog/a-guide-to-snap-permissions-and-interfaces --- 1. [Blog](https://canonical.com/blog) 2. Article --- [Alex Murray](https://canonical.com/blog/author/alexmurray "More about Alex Murray") 1 November 2018 # A guide to snap permissions and interfaces [Security](https://canonical.com/blog/tag/security) [Snap](https://canonical.com/blog/tag/snap) [snapcraft](https://canonical.com/blog/tag/snapcraft) [Ubuntu](https://canonical.com/blog/tag/ubuntu) --- Share the article Snap is a Linux application package management system which allow developers to easily publish self contained software packages (snaps) that work across many distributions and versions of Linux. Snaps have security at their heart, and are designed to ensure all applications support the principle of least privilege / authority. That is, each package only has access to the common groups of resources that it requires to perform its intended function. To support this, each package is *sandboxed* so that it runs in a constrained environment, isolated from the rest of the system – this is achieved via a combination of [AppArmor, seccomp, mount namespaces, cgroups and traditional UNIX permissions](https://docs.ubuntu.com/core/en/guides/intro/security). To then allow a package access to common resources, the snap system provides ‘interfaces’ to which packages can be granted access as required or determined by the user. This includes things like files within the user’s home directory, or files on removable media, as well as hardware devices such as webcams or audio devices (for a full list of interfaces see the [snap documentation](https://docs.snapcraft.io/supported-interfaces)). Interfaces can also be provided from one snap to another, for example to let one snap provide services via DBus to another snap application, or to provide shared content from one snap to another. Access to a given interface corresponds to a particular permission for a snap package. ## **Interface Connections** A snap interface is provided by a *slot* declared by a given snap package (the core snap itself provides many slots), whilst other snaps consume a given interface by declaring themselves as a *plug* for that interface. Each snap declares the interfaces it requires (ie. by listing these as  plugs) and are then connected to the corresponding slot by the snapd daemon either automatically, or manually, depending on the interface. Some interfaces are connected automatically to all snaps that declare a plug to them, as they present a low risk or the interface is generally useful to most snaps (such as the *desktop* and *network* interfaces). Other interfaces (such as the *removable-media* or *cups-control* interfaces) must either be connected manually by the user, are auto-connected via a specially granted exception from the Snap Store or are auto-connected by a custom device-specific gadget snap. Snap Store reviewers typically only grant exceptions when it is deemed the utility of the application will be greatly diminished if the requested interfaces are not connected automatically. The interfaces used by a snap can be shown in two ways, either graphically through the *Software* application or via the command-line. For each installed snap, a *Permissions* button is shown in *Software* that lists the interfaces the snap declares plugs to, and allows the user to manually connect or disconnect each interface as desired. The same information is also exposed via the command-line via the *snap interfaces* command. ``` $ snap interfaces gimp Slot             Plug :home            gimp,gnome-characters,gnome-logs -                gimp:cups-control -                gimp:removable-media (...) ``` In this case, as the *cups-control* and *removable-media* interfaces are not connected for the gimp snap, there is no corresponding slot listed. When connecting an interface, the user is prompted to authenticate as an administrator to ensure interface connections cannot be made by users without appropriate permission and ensuring the user is always in control of the permissions for each snap application. I hope this post gets you thinking about how snaps could work for you.  As we have seen, interfaces provide a means for snap applications to share and access common resources, whilst respecting the principle of least privilege and providing the user ultimate control over the permissions of a given application.  If you are interested in learning more about using snaps, please visit . [Get in touch Interested in running Ubuntu in your organization?](https://ubuntu.com/about/contact-us/form) ## Sign up for our newsletter Get the latest Canonical news and updates in your inbox. Work email: \*I agree to receive information about Canonical's products and services. In submitting this form, I confirm that I have read and agree to [Canonical's Privacy Notice](https://canonical.com/legal/data-privacy/contact) and [Privacy Policy](https://canonical.com/legal/data-privacy). Sign up ## Share on --- ## Related posts [### Canonical announces the alpha release of Charmed OpenShell to help secure autonomous AI agent fleets](https://canonical.com/blog/charmed-openshell-alpha-release) To streamline enterprise deployment and lifecycle management, Canonical is announcing the alpha release of Charmed OpenShell. [Canonical](https://canonical.com/blog/author/canonical) 28 September 2026 [### Ubuntu coming soon to Snapdragon X2 Series platforms, unlocking more Linux PCs for the agentic world](https://canonical.com/blog/ubuntu-coming-soon-to-qualcomm-snapdragon-x2-series-platforms) Canonical and Qualcomm Technologies announce upcoming native Ubuntu support for Qualcomm’s flagship laptop silicon, delivering multi-day battery life, 80 TOPS NPU acceleration,... [Canonical](https://canonical.com/blog/author/canonical) 23 September 2026 [### Accelerating delivery of CVE fixes with a new Kernel release strategy](https://canonical.com/blog/accelerating-delivery-of-cve-fixes-with-a-new-kernel-release-strategy) When it comes to fixing security vulnerabilities, speed is crucial. Canonical is officially outlining a transition from its current 4-week regular and 2-week security kernel... [Canonical](https://canonical.com/blog/author/canonical) 23 September 2026 [### Bring Zenoh to ROS 2 with snaps](https://canonical.com/blog/bring-zenoh-to-ros-2-with-snaps) ROS 2 gives robotics developers the freedom to choose the middleware that fits their system. As a communication protocol for ROS, Zenoh has gained strong traction. It delivers... [gbeuzeboc](https://canonical.com/blog/author/gbeuzeboc) 15 September 2026