Technical architectural analysis, practical configuration manifests, and deployment instructions for Snap Package Manager Sheet: Sandboxed.
Daemon Install
Rocky
sudo dnf install epel-release
sudo dnf upgrade
sudo yum install snapd
sudo systemctl enable --now snapd.socket
# /snap ๋๋ ํ ๋ฆฌ ์์ฑ. (classic ์ง์ ์ถ๊ฐ)
sudo ln -s /var/lib/snapd/snap /snap
sudo rebootAmazon 2023 / Fedora
Work after checking the latest release
# ์ฌ์ Dependency ์ถ๊ฐ
sudo dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm
sudo dnf upgrade
sudo dnf module install go-toolset
sudo dnf install rpmdevtools
# build ๊ตฌ์ฑ์์ ์ ์
rpmdev-setuptree
cd ~/rpmbuild/SOURCES
curl -L \
https://github.com/canonical/snapd/releases/download/2.65.3/snapd_2.65.3.no-vendor.tar.xz \
-o snapd_2.65.3.no-vendor.tar.xz
tar -xvJ -C ~/rpmbuild/SPECS -f snapd_2.65.3.no-vendor.tar.xz --strip-components=3 snapd-2.65.3/packaging/fedora
spectool -g ~/rpmbuild/SPECS/snapd.spec
sudo dnf builddep ~/rpmbuild/SPECS/snapd.spec -y
# build
rpmbuild -bb ~/rpmbuild/SPECS/snapd.spec
# install
sudo dnf localinstall \
~/rpmbuild/RPMS/x86_64/snap-confine-2.65.3-0.amzn2023.x86_64.rpm \
~/rpmbuild/RPMS/x86_64/snap-confine-debuginfo-2.65.3-0.amzn2023.x86_64.rpm \
~/rpmbuild/RPMS/x86_64/snapd-2.65.3-0.amzn2023.x86_64.rpm \
~/rpmbuild/RPMS/x86_64/snapd-debuginfo-2.65.3-0.amzn2023.x86_64.rpm \
~/rpmbuild/RPMS/x86_64/snapd-debugsource-2.65.3-0.amzn2023.x86_64.rpm \
~/rpmbuild/RPMS/noarch/snapd-devel-2.65.3-0.amzn2023.noarch.rpm \
~/rpmbuild/RPMS/noarch/snapd-selinux-2.65.3-0.amzn2023.noarch.rpm
# enable
sudo systemctl enable --now snapd.socket
# /snap ๋๋ ํ ๋ฆฌ ์์ฑ. (classic ์ง์ ์ถ๊ฐ)
sudo ln -s /var/lib/snapd/snap /snap
sudo reboot
# test
sudo snap install hello-worldExec
# ์จ๋ผ์ธ ๊ฒ์
snap search $text
# ์ค์น ํจํค์ง ์กฐํ
snap list
# ์จ๋ผ์ธ ์ค์น
snap install $package
# ์คํ๋ผ์ธ ์ค์น
snap install $path/$snapfile.snapTips
Meaning of --classic
โ Certain packages can only be installed with snap install $package --classic.
โ Snap Manager basically imposes strict security restrictions called sandboxing when installing packages, and only packages or applications that are acceptable to adhere to these restrictions can be installed.
โ For packages or applications that require system integration, the corresponding flag must be used.
What is Sandboxing?
โ Sandboxing is a security technology that runs a program or process in an isolated environment, limiting the program’s ability to influence or access the rest of the system.
โ Mainly used to minimize risks such as unexpected behavior, malicious code, and data leakage when running applications.
โ Main items
โ Isolation:
โ Applications run in a virtual environment and cannot directly access other applications or the core resources of the operating system.
โ Each application is designed to operate only within its own โsandboxโ.
โ Least Privilege:
โ Applications are granted minimal permissions and can only perform certain tasks.
โ For example, file system access rights may be restricted or network access may be blocked.
โ Security Boundary:
โ A sandbox creates a clear boundary with other parts of the operating system, preventing intrusion or exploitation.
โ This boundary strictly controls things like inter-process communication (IPC) and file sharing.
Leave a Reply