search

ErnyTech / p7zip

37 stars 14 forks source link

Access outside /home folder #6

Closed Risu closed 5 years ago

Risu commented 5 years ago

I can not access files outside /home folder. I've got mounted external drives at /media/ but files there are not visible in p7zip-desktop's main window. I am on KDE.

RogueScholar commented 5 years ago

I'm not the developer, obviously, but I fought with the same issue myself and did eventually find a path to better functionality. It turned out that AppArmor was having a field day telling the app that it couldn't do a lot of normal operations for a file manager/archiver. The workaround was thus:

sudo cp -R /etc/apparmor.d/abstractions /var/lib/snapd/apparmor/profiles
sudo cp -R /etc/apparmor.d/tunables /var/lib/snapd/apparmor/profiles

That copies the low-level heuristic files that AppArmor uses to figure out which types of files and folders are germane to what the app needs and which aren't without having to specify every-dang-last-one of them explicitly somewhere. Once that was done, I could use all the AppArmor tools one normally uses for stuff installed via dpkg with my installed snaps. In particular, I wanted to use aa-logprof to look at all the denials things had been receiving and let me add them manually to the approvals in the rules files. It looks like this:

sudo apt install apparmor-utils
sudo aa-logprof -d /var/lib/snapd/apparmor/profiles -f /var/log/kern.log

Now I make no guarantee that this is good advice for you to follow, in fact I'm quite certain that a lot of people want to crucify me right about now for suggesting that I so casually "unsandboxed" what the Snap dudes have gone to such ridiculous lengths to make safe for use. It's certainly true that a malicious binary could take my extra grants of filesystem access and ravage me like a cheap trollop in a dark alley with what I just described doing. In the end though I just wanted to extract some old archives and I missed using the 7zip GUI from back in the Windows days, so I rolled the dice.

...but I got those archives extracted, too. :grin:

ErnyTech commented 5 years ago

I can enable access to external devices without compromising the integrity of the confinement, but I cannot in any way allow exclusive access to everything

no95typem commented 5 years ago

I can enable access to external devices without compromising the integrity of the confinement, but I cannot in any way allow exclusive access to everything

Yes, can you please add support of "media" interface for snap? It should give access to /media and /mnt, and this must be enough for user experience.

ErnyTech commented 5 years ago

Done https://github.com/ErnyTech/p7zip/commit/6211c7581d55161ad86efc3f343111df5caaac92

Risu commented 5 years ago

Adding "- removable-media" to snapcraft.yaml is not enough to gain access to files. There is segmentation fault after trying access /media/ in p7zip-dekstop window.

no95typem commented 5 years ago

Adding "- removable-media" to snapcraft.yaml is not enough to gain access to files. There is segmentation fault after trying access /media/ in p7zip-dekstop window.

Do you connect new interface? After connecting new interface for me /mnt and /media works fine. snap connect p7zip-desktop:removable-media And maybe set this interface for autoconnect for snap?

Risu commented 5 years ago

I've done more testing and it crash only on root folder (/media/). When I go inside path it working fine (like /media/xxx/). Weird.

hollysheep commented 5 years ago

Is the problem solved? I have the same problem on Ubuntu 18.04 with the lastest p7zip-desktop from snap.

ErnyTech commented 5 years ago

I have just released the new version of p7zip on the stable channel with the fix for accessing external devices. Snap should auto update the package in every pc, but to force the update you can execute: snap refresh

After updating, in order to access external devices in respect to the Snap standard, it is necessary to enable the permission through the Snap Store or via a terminal with snap connect p7zip-desktop: removable-media

darmbrust commented 4 years ago

Can you publish some sort of docs of how we make this usable for paths outside of the home folder that aren't removable media? Because the GUI is pretty useless for me now.... I have a Downloads folder that is on a different file system, for example, and the GUI just fails with useless, generic "permission denied" messages, that provide no info as to why, or how to get permission.