How to Manage Snap Interfaces and Security Permissions in Ubuntu Using snap connect

On modern Ubuntu desktop and server systems, many essential tools and services run packaged as Snaps. Snaps deliver robust application isolation by confining software inside sandboxed environments managed by AppArmor, cgroups, SecComp, and device cgroups. By default, applications installed under strict confinement are completely isolated from host hardware and personal data: they cannot access external USB drives, use system webcams, record audio, or manipulate low-level network sockets.

To provide controlled access to host system resources, the snapd framework utilizes an interface model based on plugs (consumer attributes declared by the application) and slots (provider capabilities exposed by the core system or other snaps). Using the snap connect and snap disconnect commands, systems administrators can grant or revoke specific hardware and filesystem permissions on Ubuntu.

Understanding Snap Interfaces: Plugs and Slots

Snap security boundaries are mediated through typed interfaces:

• Plug: Declared by a client application requiring access to an external resource (e.g., removable-media, camera, network-control, audio-record).
• Slot: Provided by the host core operating system snap (:core or :system) or another snap that exposes a capability.
• Auto-Connection vs Manual Connection: While safe interfaces like internet access (network) connect automatically upon installation, privileged or sensitive hardware interfaces remain disconnected by default until approved manually by an administrator.

Inspecting Installed Snap Interfaces and Connections

To inspect all interfaces currently available and connected across your Ubuntu system, use snap connections:

snap connections

To filter connections for a specific application (for example, the Chromium or VLC snap):

snap connections vlc

The command outputs a structured table detailing active plugs and their assigned slots:

Interface        Plug                Slot                 Notes
audio-playback   vlc:audio-playback  :audio-playback      -
camera           vlc:camera          -                    -
network          vlc:network         :network             -
removable-media  vlc:removable-media -                    -

Notice that for camera and removable-media, the Slot column contains a hyphen (-). This indicates that the plug is currently disconnected and the application is blocked from accessing those resources.

Granting Permissions with snap connect

Consider a common operational scenario where VLC or an enterprise media tool cannot open files stored on external USB drives mounted at /media/ or /mnt/. The application requires the removable-media interface.

Connect the plug to the system slot using snap connect:

sudo snap connect vlc:removable-media

If connecting to the host system core, specifying :removable-media as the target slot is optional if omitted. To explicitly specify the core provider slot:

sudo snap connect vlc:removable-media :removable-media

Verify that the interface is now connected:

snap connections vlc | grep removable-media

The output now displays :removable-media under the Slot column, confirming that AppArmor security profiles have updated dynamically to permit filesystem access to /media/.

Common Hardware and System Interfaces

System administrators frequently manage several critical interfaces across enterprise workstations and servers:

Interface Name	Granted Capability	Common Use Case
removable-media	Read/write access to mounts under /media/ and /mnt/	Accessing USB flash drives, SD cards, and external hard disks
camera	Access to video capture devices in /dev/video*	Video conferencing applications and webcam streaming tools
audio-record	Access to audio input devices (microphones) via PulseAudio/PipeWire	Voice recorders, audio editors, and VoIP clients
raw-usb	Direct access to raw USB devices via libusb	Flashing firmware, microcontroller development, and 3D printers
network-control	Allows configuring network interfaces, routes, and firewalls	VPN clients, packet sniffers, and network diagnostics tools

Revoking Permissions with snap disconnect

If an application should no longer have access to a sensitive interface—for example, revoking webcam access to harden privacy—use snap disconnect:

sudo snap disconnect vlc:camera

The AppArmor confinement profile recompiles instantly, immediately blocking the application process from opening video capture device nodes.

Debugging Security Denials and AppArmor Blocks

When an application fails to access a file or socket, check whether the failure is caused by an unfulfilled Snap interface or a standard Linux file permission error. Query the systemd journal for AppArmor denial events:

sudo journalctl -e -u snapd

To inspect AppArmor audit messages in real time while launching the application:

sudo dmesg | grep -i "apparmor=\"DENIED\""

A typical denial message identifies the missing interface:

apparmor="DENIED" operation="open" profile="snap.vlc.vlc" name="/media/user/USB/video.mp4" requested_mask="r" denied_mask="r"

Seeing a denial against /media/ immediately confirms that running sudo snap connect vlc:removable-media will resolve the issue.

By effectively inspecting and governing Snap interfaces through snap connect and snap disconnect, Ubuntu administrators enforce least-privilege security while providing applications with necessary hardware access.