Why can snap files not be modified in any way?

Question

I have been trying for a long time to change Blender's icon, but no matter what I do, I am not allowed to edit anything in /snap/blender-tpaw/3/.

Here's what I tried:

• Editing the files from nautilus without sudo.
• Editing the files from nautilus with sudo (sudo nautilus in terminal ).
• Using terminal commands such as cp or rm without sudo.
• Using terminal commands with sudo (such as sudo cp <source> /snap/blender-tpaw/3/ or sudo rm /snap/blender-tpaw/3/<filename.ext>)
• Doing everything above in a root terminal (using sudo -i)

In every case I get the following error:

cannot remove/copy '/snap/blender-tpaw/3/filename.ext': Read-only file system

where filename is the file and .ext is its extension.

This also applies to other snaps' files, not only Blender.

Am I doing something wrong here? Or is it just impossible to change those files? Although I don't think it is impossible because everything here from Ubuntu to Blender is open-source, so they have no reason to block us from modifying those files.

EDIT:

I used Main Menu (alacarte) to change the icon, but I still want to know why I cannot modify any snap file.

Solution 1

It's impossible to change the contents of the snap without re-building the snap. This is primarily a security measure, to ensure that the snap hasn't been tampered with.

However, the icon referred to is likely in a desktop file called blender-tpaw_blender.desktop which is editable, and can be found in /var/lib/snapd/desktop/applications.

You could change the following line to update the icon:-

Icon=/snap/blender-tpaw/3/meta/gui/icon.svg

Solution 2

While the premise of the question is technically correct (you can't change files of a snap), there are ways to work around this.

One such way is to use the --bind option in conjunction with mount, to remount the existing file hierarchy to somewhere else.

For example, if you want your snaps to use the system certificates instead of the certificates installed in core, you can mount the directory containing the system certificates on the host on top of the system certificates directory in core with the following command:

sudo mount --bind -o nodev,ro /etc/ssl/certs /snap/core/current/etc/ssl/certs/

This doesn't actually change the snap filesystem. If you unmount the folder, the old folder will take its place:

sudo umount /snap/core/current/etc/ssl/certs

Note: Mounts do not persist between reboots. There are several ways to make mounts persist after a reboot. One such way is to create a systemd startup script:

$ cat <<-EOF | sudo tee /etc/systemd/system/snap-core-current-etc-ssl-certs.mount
[Unit]
Description=Mount unit to fix etc ssl certs in core package
After=snapd.service

[Mount]
What=/etc/ssl/certs
Where=/snap/core/current/etc/ssl/certs
Type=none
Options=bind,nodev,ro

[Install]
WantedBy=multi-user.target
EOF
$ systemctl enable snap-core-current-etc-ssl-certs.mount

Taken from here.

Comments

[sxc731]

Great solution, thanks v. much! Just one niggle: newer systemd versions (the one on 18.04 as of this writing) no longer accept mounts atop paths that contain soft-links; thankfully the above config could be replaced with a line in /etc/fstab, eg: echo -e "/etc/ssl/certs\t/snap/core/current/etc/ssl/certs\tnone\tbin‌​d,nodev,ro\t0 2" | sudo tee -a /etc/fstab -- source

[Almir Campos]

This "impossible to change" thing with snap is very - I mean, VERY - annoying! The main reason I would like to use snap is that I want to make parallel installations of the same program (eg. Firefox) and then make experiments with the "copy" installation without messing up the main installation. By the way, the change on the .desktop file didn't work in the case of Firefox.

[SArcher]

It's not "impossible", it's just not how snap is designed. Snap files are SquashFS images -- they can be updated without using any snap-specific tools.