Jtdcftul

I tried to install MS Visual Studio Code as snap on Ubuntu 16.04 with the following command:

sudo snap install vscode

but I've got the following error:

error: This revision of snap "vscode" was published using classic confinement and thus may perform

       arbitrary system changes outside of the security sandbox that snaps are usually confined to,

       which put your system at risk.



       If you understand and want to proceed repeat the command including --classic.

I'd like to know what does --classic flag do (not just man page explanation) and why did I get the previous error while I was installing Visual Studio Code.

Watch this short video that explains each of the confinement models available in snaps, why --classic exists and it's use case.

Sources: The following documentation is taken from snapcraft.io: confinement policies.

strict

This is the default security policy applied to snaps. The snap has read and/or write rights only in its own install space and selected areas. It has access to libraries it bundles and/or provided by the core or ubuntu-core snap. Extended rights can be granted with interfaces, which are connected either at install time or by the user with the snap connect command. For example, the home interface will grant read rights in the user’s home.

Strict confinement gives you the following readable and/or writable paths:

• /snap/snapname/revision (read-only, snap install path)


• /var/snap/snapname/revision (read/write, per-revision data)


• /var/snap/snapname/common (read/write, common data)


• /home/$USER/snap/snapname/revision (read/write, per-revision user data)


• /home/$USER/snap/snapname/common (read/write, common user data)

See the list of environment variables for more details on what is visible to a strictly confined snap, as well as ways to access a shell within the confined space of a snap.

devmode

Developer mode, also known as devmode, uses the same security policies as strict confinement, but security denials are turned into warnings in /var/log/syslog (see Debugging). This is useful when snapping an application, to discover which interfaces need to be declared. Snaps in developer mode can not be released into the stable and candidate store channels.

classic

A snap in classic confinement behaves as a traditionally packaged application, with full access to the system. As opposed to strict and devmode, what a classic snap sees as “/” is the host system’s “/” and not the core snap’s “/”. Snaps using this fully open security policy are manually reviewed in the store and are only allowed on systems where snapd is installed on top of a traditional Linux distribution, as opposed to system booting from an Ubuntu Core image. They can be released in all store channels.