snap-installed version gets Permission denied when sending any file?

I recently installed a new Ubuntu server (“bionic”), and was flattered to see that wormhole is offered (next to docker and kubernetes and other popular tools) during the installation process, as a snap package. But when I then tried to use it in a simple file transfer, it stalled for a long time (maybe 30 seconds?), and then failed with a “Permission denied” error:

$ wormhole send ~/.profile
Sending 807 Bytes file named '.profile'
Traceback (most recent call last):
  File "/snap/wormhole/112/lib/python2.7/site-packages/twisted/internet/defer.py", line 654, in _runCallbacks
    current.result = callback(current.result, *args, **kw)
  File "/snap/wormhole/112/lib/python2.7/site-packages/twisted/internet/defer.py", line 1475, in gotResult
    _inlineCallbacks(r, g, status)
  File "/snap/wormhole/112/lib/python2.7/site-packages/twisted/internet/defer.py", line 1416, in _inlineCallbacks
    result = result.throwExceptionIntoGenerator(g)
  File "/snap/wormhole/112/lib/python2.7/site-packages/twisted/python/failure.py", line 491, in throwExceptionIntoGenerator
    return g.throw(self.type, self.value, self.tb)
--- <exception caught here> ---
  File "/snap/wormhole/112/lib/python2.7/site-packages/wormhole/cli/cli.py", line 122, in _dispatch_command
    yield maybeDeferred(command)
  File "/snap/wormhole/112/lib/python2.7/site-packages/twisted/internet/defer.py", line 1416, in _inlineCallbacks
    result = result.throwExceptionIntoGenerator(g)
  File "/snap/wormhole/112/lib/python2.7/site-packages/twisted/python/failure.py", line 491, in throwExceptionIntoGenerator
    return g.throw(self.type, self.value, self.tb)
  File "/snap/wormhole/112/lib/python2.7/site-packages/wormhole/cli/cmd_send.py", line 91, in go
    yield d
  File "/snap/wormhole/112/lib/python2.7/site-packages/twisted/internet/defer.py", line 1418, in _inlineCallbacks
    result = g.send(result)
  File "/snap/wormhole/112/lib/python2.7/site-packages/wormhole/cli/cmd_send.py", line 105, in _go
    offer, self._fd_to_send = self._build_offer()
  File "/snap/wormhole/112/lib/python2.7/site-packages/wormhole/cli/cmd_send.py", line 309, in _build_offer
    fd_to_send = open(what, "rb")
exceptions.IOError: [Errno 13] Permission denied: u'/home/warner/.profile'
ERROR: [Errno 13] Permission denied: u'/home/warner/.profile'

I don’t think I did anything special during the install, beyond selecting the “wormhole” option, so I’m guessing that the default sandboxing options for this snap package are too restrictive. I know snaps have some clever mechanisms to prevent the application from getting more authority than it really needs (which is awesome, I’m a huge fan of POLA), but I don’t know if programs which are meant to read arbitrary (user-chosen) files need to coordinate their open() calls with the snap runner somehow.

[dwasyluk]

having this issue as well.

[warner]

Ok, maybe the best answer is to simply document the limitations: you can only send-receive files from your home directory, and you can’t send/receive dotfiles that live directly under $HOME. You can’t send a file from someone else’s home directory (even if you can read it with other tools, maybe because you’re running as root, or because the file is chmod a+r), you can’t send a file from /etc or /usr or anywhere outside your home directory, and doing anything in /tmp is going to be pretty strange because it has a persistent shadow world that’s shared by all users.

We could maybe have wormhole try to sense if it’s in a snap environment (look at argv[0]??) and print a warning/explanation if it gets a permission error, pointing to this Issue, but that smells pretty funny to me.

I’ll file a ticket on the snapcrafters page to see if they have any advice, maybe it would be appropriate to add a system-files: that asks for full access.