Interfaces¶
Interfaces enable resources from one snap to be shared with another and with the system. The table below lists currently supported interfaces, with links to further details for each interface.
The following column names are used:
Interface is the syntactical interface name, as used by snaps.
Description is a brief overview of what the interface permits. Select the interface name to open the interface-specific page for a more detailed description on each interface.
Categories are used to split interfaces into broad types, and also to indicate what kind of access they permit. Video, graphics and audio are typical desktop requirements, for example, while VM, Container, Kernel and Developer imply more specific roles. The Ubuntu Core category is used to denote when an interface is intended for Ubuntu Core, and Super privileged is used when an interface requires extra security scrutiny. See Super-privileged interfaces for more information.
Auto-connect indicates that the interface will be connected by default when the snap is first installed, requiring no further user action. If
Auto-connect=no, an interface can still be automatically connected if the snap developer has requested, and been granted, explicit permission. See Interface connection mechanism for details.
Interface |
Description |
Categories |
Auto-connect |
|---|---|---|---|
add/remove user accounts or change passwords |
System, Account |
no |
|
allows communication with the accounts service |
System, Account |
no |
|
allows access to user VMs using the ACRN hypervisor |
VM, Hypervisor, Developer |
no |
|
allows operating as Android Debug Bridge service |
ADB, Developer |
no |
|
access the Allegro Video Core Unit |
Video, Graphics |
no |
|
play or record sound |
Audio, Media |
no |
|
allows access to AppStream metadata |
System, Developer, Manage software |
no |
|
allows audio playback via supporting services |
Audio, Media, Playback |
yes |
|
allows audio recording via supported services |
Audio, Media, Record |
no |
|
be controlled by Autopilot software |
System, Developer |
no |
|
advertise services over the local network |
Network, Local network, Nearby devices |
no |
|
detect services and devices over the local network |
Network, Local network, Nearby devices |
no |
|
access to disk block devices |
Super privileged, Storage, Low level |
no |
|
access Bluetooth hardware directly |
Network, Bluetooth, Nearby devices |
no |
|
use Bluetooth devices |
Network, Bluetooth, Nearby devices |
no |
|
allows access to specific file with bool semantics |
System, Low level, Privileged |
no |
|
control Broadcom network switches |
no |
||
use functions essential for Web browsers |
Browser, Network |
no when allow-sandbox: true, yes otherwise |
|
allows communication with Evolution Data Server calendar |
Personal data, Contacts and calendar |
no |
|
use your camera or webcam |
Camera, Media, Personal data |
no |
|
allows access to the CAN bus |
System, Developer |
no |
|
allows the mounting and unmounting of CIFS filesystems |
Network,Storage |
no |
|
enable resource access to classic snap |
Super privileged, Ubuntu Core |
no |
|
permit access confdb configuration system |
System |
no |
|
allows communication with the Evolution Data Server address book |
Personal data, Contacts and calendar |
no |
|
access resources across snaps |
Storage, Files, Attributes |
yes for snaps from same publisher, no otherwise |
|
deprecated since snap 2.34 |
System, Other |
no |
|
set certain CPU values |
System, Developer |
no |
|
access to the CUPS socket for printing |
Printing |
not applicable |
|
print documents |
Printing |
no |
|
permits access to a specific class of device |
Super privileged, Ubuntu Core |
no |
|
allows sending daemon status changes to service manager |
System, Developer |
no |
|
allow snaps to communicate over D-Bus |
System, Developer |
no |
|
shut down or restart Dell devices |
Developer |
no |
|
provides access to common desktop elements |
Desktop |
yes |
|
identify and launch desktop apps from other snaps |
Super privileged, Desktop |
no |
|
enables the use of legacy desktop methods (including input method and accessibility services) |
Desktop |
yes |
|
use any device-buttons |
Hardware, Developer |
no |
|
allows configuring display parameters |
Display, Graphics |
no |
|
access encrypted storage devices |
Super privileged, Ubuntu Core, Storage |
no |
|
start, stop, or manage Docker containers |
Super privileged, Containers |
no |
|
allows operating as the Docker daemon |
Super privileged, Containers |
no |
|
enables the control of digital signal processors (DSPs) |
Hardware, Developer |
no |
|
renamed to empty interface |
System, Other |
no |
|
allows access to all DVB devices and APIs |
no |
||
allows testing without additional permissions |
System, Other |
no |
|
configure a network firewall |
no |
||
permits access to an FPGA subsystem |
Hardware, Developer |
no |
|
access to universal framebuffer devices |
Hardware, Developer |
no |
|
enables access to the FUSE filesystems |
Storage |
no |
|
allows operating as the fwupd service |
no |
||
access the legacy GConf config system |
System, Developer, Settings |
no |
|
read GPG user configuration and keys |
GPG, Personal data, Security |
no |
|
read GPG non-sensitive configuration and public keys |
GPG, Personal data, Security |
no |
|
access specific GPIO pins |
GPIO, Hardware, Developer |
no |
|
allows to export/unexport and control all GPIOs |
Super privileged, GPIO |
no |
|
allows write access to all GPIO memory |
GPIO, Hardware, Developer |
no |
|
allows operating as the Greengrass service |
Super privileged, Edge, AWS, Discrete |
no |
|
provides access to any GSettings item for current user |
System, Developer, Settings |
yes |
|
access hardware information |
no |
||
provide entropy to hardware random number generator |
no |
||
use hardware-generated random numbers |
no |
||
access hidraw devices |
no |
||
access non-hidden files in the home directory |
Storage, Personal data |
yes on classic (traditional distributions), no otherwise |
|
allows configuring the system hostname |
no |
||
control HugePages memory blocks |
System, Memory, Kernel |
no |
|
access i²c devices |
no |
||
access IIO devices |
no |
||
access to the Intel MEI management interface |
System, Firmware |
no |
|
provides permissions for Intel QAT devices |
no |
||
allows access to all I/O ports |
no |
||
access Android’s ION memory allocator |
no |
||
allows interaction with the JACK audio connection server |
Audio, Media |
no |
|
use any connected joystick |
Hardware, Developer |
no |
|
read the Juju client configuration |
Developer, Discrete |
no |
|
read and manage kernel supported crypto ciphers |
no |
||
permits a custom kernel firmware search path |
no |
||
insert, remove and query kernel modules |
Super privileged, System, Kernel |
no |
|
load, or deny loading, specific kernel modules |
Super privileged, System, Kernel |
no |
|
query kernel modules |
System, Kernel |
no |
|
use functions essential for Kubernetes |
Super privileged, Hypervisor, Discrete |
no |
|
allows access to the kvm device |
VM, Hypervisor, Developer |
no |
|
provides access to the libvirt service |
VM, Hypervisor, Developer |
no |
|
change system language and region settings |
Language and region, Personalisation |
no |
|
allows operating as the location service |
Location |
no |
|
access your location |
Location |
no |
|
read system logs |
System, Developer |
no |
|
allows setup of login sessions and grants privileged access to user sessions |
no |
||
allows reading login and session information |
no |
||
provides access to the LXD socket |
Super privileged, Container, Discrete |
no |
|
allows operating as the LXD service |
Super privileged, Container, Discrete |
no |
|
use an on-screen keyboard |
Developer |
no |
|
access media control devices and Video4Linux (V4L) devices |
no |
||
access snaps providing the media-hub interface |
Developer, Media |
yes |
|
permits access to the MicroCeph socket, which is used internally by the microceph snap |
Super privileged, Container |
no |
|
permits the microceph snap to operate as the MicroCeph service |
Super privileged, Container |
no |
|
used only by the MicroOVN snap for socket access |
no |
||
multiple service access to the Microstack infrastructure |
Super privileged, Container, Discrete |
no |
|
enables access to the Mir display service |
Display |
yes |
|
use and configure modems |
no |
||
mount and unmount transient and persistent filesystem mount points |
Super privileged, Storage |
no |
|
read mount table and quota information |
Storage |
no |
|
media key control of music and video players |
Sound |
no |
|
multipass-support allows operating as the Multipass service |
Super privileged, VM, Discrete |
no |
|
allows access to kernel audit system through Netlink |
Inter-process communication (IPC), Netlink, Developer |
no |
|
communicate through the kernel Netlink connector |
Inter-process communication (IPC), Netlink, Developer |
no |
|
operate a kernel driver module exposed via Netlink |
Inter-process communication (IPC), Netlink, Developer |
no |
|
enables network access |
yes |
||
operate as a network service |
yes |
||
change low-level network settings |
no |
||
configure and observe networking via NetworkManager |
no |
||
allows observing NetworkManager settings |
no |
||
query network status information |
no |
||
change network settings via Netplan |
no |
||
read network settings |
no |
||
access the NetworkStatus service |
yes |
||
allows the mounting and unmounting of Network File System mount points |
Network, Service |
no |
|
enable’s HashiCorp’s Nomad to access CPU and memory management |
System, Containers, Service |
no |
|
internally used NVIDIA access |
Super privileged, Ubuntu Core |
no |
|
allows operating as the oFono service |
Network, Discrete, Developer |
no |
|
access to the Online Accounts service |
Service, Developer |
yes |
|
access OpenGL/GPU hardware |
Display, Graphics |
yes |
|
control Open vSwitch hardware |
Network, Service, Developer |
no |
|
enables kernel support for Open vSwitch |
Network, Service, Developer |
no |
|
read/write access to CD/DVD drives |
Storage, Hardware, Developer |
yes, unless drive can write |
|
control the PackageKit service |
Super privileged, Packaging |
no |
|
read, add, change, or remove saved passwords |
no |
||
permits communication with PCSD smart card daemon |
no |
||
read or write files in the user’s home directory |
Super privileged, Personal data, Attributes |
no |
|
read and write memory used by any process |
System, Memory, Kernel |
no |
|
read memory used by any process |
System, Memory, Kernel |
no |
|
access the PipeWire server |
Audio, Media, Video |
no |
|
enables the cryptographic token interface standard to be used |
no |
||
access to the polkit authorisation manager |
no |
||
permits applications to register as polkit agents |
no |
||
enables inter-process communication (IPC) messages |
Super privileged, IPC |
no by default, yes with snaps from the same publisher |
|
read and write system power settings |
System, Power |
no |
|
access to configure and observe PPP networking |
no |
||
pause or end any process on the system |
no |
||
access to the Precision Time Protocol subsystem |
System, Developer |
no |
|
play and record sound |
Audio, Media |
no |
|
access specific PWM channels |
no |
||
access Qualcomm IPC router sockets |
IPC, Kernel, System |
no |
|
access raw input devices directly |
no |
||
access USB hardware directly |
no |
||
access specific disk partitions |
Storage |
no |
|
interact with the kernel’s Remote Processor Framework |
no |
||
read-only access to ROS directories |
Storage |
no |
|
allows the snaps ros-snapd and ros2-snapd the use of snapd’s apps control API |
no |
||
read/write files on removable storage devices |
Storage |
no |
|
allows screen recording and audio recording alongside writing to arbitrary filesystem paths |
Legacy |
no |
|
prevent screen sleep, lock and screensaver |
Display |
yes |
|
read and write access to SCSI Generic driver devices |
Storage, Super privileged |
no |
|
control SD cards on specific devices |
Super privileged, Storage |
no |
|
access serial port hardware |
no |
||
enables two snaps to access the same shared memory |
Super privileged, IPC |
no by default, yes with snaps from the same publisher |
|
restart or power off the device |
Super privileged, System, Power |
no |
|
enables the prompting API and its access to prompting-related notice types |
no |
||
permits bespoke snap refresh control |
Super privileged, Packaging |
no |
|
enables the tracking of snap refreshes |
Super privileged, Packaging |
no |
|
install or remove software |
Super privileged, Packaging |
no |
|
access specific SPI devices |
no |
||
access SSH private and public keys |
no |
||
access SSH public keys |
no |
||
allows the Steam snap to access pressure-vessel containers |
Super privileged, Discrete |
no |
|
operate as, or interact with, the Storage Framework |
Storage |
no |
|
read-only access to the system for backups |
Storage |
no |
|
read or write files in the system |
Super privileged, Storage, Attributes |
no |
|
read process and system information |
Monitoring, System |
no |
|
access system documentation in /usr/share/doc |
Developer |
no |
|
access kernel source and headers in /usr/src |
Developer |
no |
|
monitor or control any running program |
Monitoring, System |
no |
|
permits access to the Trusted Execution Environment |
Super privileged, Security, Ubuntu Core |
no |
|
create thumbnail images from local media files |
Storage, Media |
no |
|
change the date and time |
Time |
no |
|
change time server settings |
Time |
no |
|
change the time zone |
Time |
no |
|
allows access to the Trusted Platform Module device |
Kernel, Security |
no |
|
use any U2F devices |
no |
||
use the Ubuntu Download Manager |
System, Developer, Manage software |
yes |
|
access the UDisks2 service |
Storage |
no |
|
create kernel UID devices from user-space |
no |
||
allows write access to /dev/uinput |
no |
||
access uio devices |
no |
||
access legacy desktop resources from Unity7 |
Display |
yes |
|
share data with other Unity 8 apps |
Display, Super privileged |
yes |
|
read/change shared calendar events in Ubuntu Unity 8 |
Personal data |
no |
|
read/change shared contacts in Ubuntu Unity 8 |
Personal data |
no |
|
access battery level and power usage |
System, Power |
yes |
|
permits a snap to create a new namespace |
no |
||
access a Raspberry Pi’s VideoCore multimedia processor |
Video, Graphics, Ubuntu Core |
no |
|
access compositors providing the Wayland protocol |
Display |
yes |
|
monitor mouse/keyboard input and graphics output of other apps |
Display |
yes |
|
allows access to Xilinx DMA IP from a connected PCIe card |
Ubuntu Core, Super privileged |
no |