Mastering Ubuntu's Enhanced Snap Permission Prompts: A Practical Guide

Overview

Ubuntu’s snap package system has long been praised for its security isolation, but the user experience around granting permissions often felt clunky—requiring manual command-line interventions or post-install tweaks. In the latest Ubuntu release (24.04 LTS and newer), Canonical has radically revamped the permission-prompting mechanism for snaps, bringing a mobile-style, runtime permission model to the desktop. Now, when a snap app needs access to your camera, microphone, location, or other system resources, you’ll see a clear modal dialog asking for consent—much like on Android or iOS. This tutorial walks you through the new feature, shows you exactly how to use it, and helps you avoid common pitfalls.

Prerequisites

• Ubuntu 24.04 LTS or later (or a rolling release with recent snapd updates).
• An installed snap application that can request permissions (e.g., Zoom, Firefox, or any snap with camera/microphone capabilities).
• Basic familiarity with the terminal (optional, for advanced configuration).
• Your system’s snapd updated to at least version 2.63. To check, run: snap version.

Step-by-Step Instructions

1. Launch a Snap App That Requests a Permission

Open any snap application that requires hardware access. For example, start the Firefox snap and attempt to use the camera for a video call. Instead of silently granting access, Ubuntu will now present a permission dialog.

Expected behavior: A pop-up window appears with text like: “Allow ‘Firefox’ to access the camera?” With options: Deny, Allow once, and Allow while using the app. This is the new runtime prompt.

If you see no prompt, ensure you are running Ubuntu 24.04+ and snapd 2.63+. Also verify that the snap is confined (not using --classic).

2. Understand the Three Choices

• Deny: The app is blocked from accessing the resource. It might show an error or fallback behavior.
• Allow once: Permission is granted only for the current session. After you close the app, the permission resets.
• Allow while using the app: Permission persists as long as the app is open. If you close and relaunch, you may be prompted again (unless you choose “always allow” in a future variant).

These choices give you fine-grained control without needing to remember command-line commands.

3. Check and Manually Manage Permissions (Optional)

You can still use the traditional snap connections command to see all interfaces (permissions) granted to a snap. For example:

snap connections firefox

This shows a list like camera, audio-record, etc., along with their connection state (attached or disconnected). To manually connect a permission that was denied earlier:

snap connect firefox:camera

To disconnect:

snap disconnect firefox:camera

Note: The new prompt system will automatically adjust these connections when you choose “Allow while using the app”—you don’t need to run these commands unless you want to pre‑authorize or revoke.

4. Test Multiple Apps and Resources

Repeat the process with different snaps and different resources:

• Microphone: Launch a voice-recording snap (e.g., gnome-recipes snap that uses audio).
• Location: Open a maps app that requests geolocation.
• File system: Some snaps request access to removable media—prompts will appear when you plug in a USB drive.

In each case, the prompt adapts to the specific resource and snap.

5. Tweak Prompt Behavior (Advanced)

You can configure global or per-snap permission prompt policies through snapd’s configuration. Edit the file at /var/snap/snapd/current/snapd-user-scope.conf (requires root). For instance, to disable all prompts system-wide (not recommended for security):

echo 'permissions-prompt: false' | sudo tee /var/snap/snapd/current/snapd-user-scope.conf

Restart the snap user session: systemctl --user restart snapd.session. To only allow prompts for certain resources, see the upstream developer documentation.

Common Mistakes

Mistake 1: The Prompt Never Appears

If you don’t see the permission dialog when opening a snap app, check:

• Your Ubuntu version is 24.04+ (check with lsb_release -a).
• Your snapd is up to date: sudo snap refresh snapd.
• The app is truly a snap (not a DEB or Flatpak). Run snap list to see installed snaps.
• The snap is not running in --classic confinement (classic snaps bypass the prompt system). Check with snap info <app>.

Mistake 2: “Allow once” Doesn’t Work as Expected

The “Allow once” permission persists only for the duration of the app process. If the app spawns a sub-process or restarts internally, you may be prompted again. This is by design. To avoid repeated prompts, use “Allow while using the app” for the session.

Mistake 3: Can’t Revoke a Past “Allow While Using”

Once you’ve selected “Allow while using the app”, the permission remains active for that app session. To revoke it, you must either:

1. Close the app entirely and relaunch (the prompt may reappear if the permission isn’t saved permanently).
2. Manually disconnect the interface with snap disconnect <app>:<interface>.

Currently, there is no “remember my choice forever” option in the GUI prompt, so each new session may ask again unless you manually connect the interface once (which then persists).

Mistake 4: Permissions Not Available for Non-Snap Apps

The new prompting system works only for snaps. Traditional Debian packages or Flatpaks do not benefit from this feature. If you need similar control for other app formats, consider using Flatpak’s permission portal or AppArmor profiles.

Summary

Ubuntu’s overhauled snap permission prompts bring a user-friendly, granular access control system to Linux desktops. By presenting clear, runtime dialogs for camera, microphone, location, and other resources, you no longer need to dig through command-line tools to grant or deny permissions. This guide covered how to experience the new prompts, manually manage connections as a fallback, and avoid common missteps like missing prompts or confusion over session-based permissions. With this feature, Canonical has made Ubuntu more secure and intuitive—keeping sensitive hardware access exactly where it belongs: in your hands.