Linux Security Summit Europe 2022

Canonical uses snap application sand boxing to improve application security. While applications can be rewritten or modified to use portals and other privilege separation there are many applications that need to be run from confinement without modification. This presentation will cover the set of techniques being used and/or experimented with to improve application confinement without over burdening the user. This includes a variety of different techniques from notifying notifying userspace to allow it to provide policy updates and a more nuanced response, application and file tagging, to providing better control over environment variables and dynamic policy composition.