Questions[restricted-access](ubuntu)

I recently upgraded to Ubuntu 20.04 from the 18.04 version. Since then, the snap-based chromium browser that comes with 20.04 is unable to access any items in the /opt partition which I have separately mounted on my system.

If I go to the trouble of installing a non-snap-based version of chromium, I do not have this problem under 20.04.

I'm not sure, but I think this problem with accessing filesystems outside of the one on which a snap program is running might be present in all snap-based software, not just chromium.

How can I get chromium and all other snap-based programs to see all the filesystems that I have mounted?

Thank you very much.

PS: On my system, /opt is mounted via the following line within /etc/fstab ...

UUID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx /opt ext4 defaults,auto 0 0

... where the x's take the place of an actual, valid UUID.

PPS: All non-snap-based software on my system has no trouble whatsoever in accessing anything on this /opt partition.

PPPS: The suggested solution in the referenced article does not solve my problem, because I would have to change my system around (changing mounts, paths, scripts, etc.), simply to get this crippled, snap-based chromium to work as it used to work before. My goal is to not change my long-standing system setup at all, but rather, to simply install a version of chromium which can run in the same way that I have been running it for years. The answer I have now posted shows the way I learned how to do this. After discovering that method to eliminate the snap-based chromium and replace it with the traditional version, it took me no longer than 10 minutes to replace chromium so that everything runs like it always has been able to run.

I'm again and again getting annoyed by the fact that snaps don't see the "real" /tmp.

One example why this is bad is that I'm unable to use "Open with -> Xournalpp" with PDFs from email attachments in Thunderbird because they are stored in the real /tmp for this.

Is there any way (however hacky it may be) to change this so that every snap can access /tmp?

One of the promoted advantages of Snap packages is the sandboxing-feature, where a Snap program may not be able to access as much system information as a package from the repository.

Now, I have read a lot about permission problems with Snap software and how to fix them, but I don't know where to find actual information on what permissions a specific Snap package has.

The Snapcraft-website is also very brief about this.

As one concrete example: How can I find out what permissions the Discord Snap gets and (how) am I able to modify those permissions to basically only allow Pulseaudio/microphone access? (Because that's all it needs to have.)

Ransomware attacks could use zero-day exploits, but often an attacker will just fool a gullible user into running an executable by downloading and clicking.

Suppose we have a naive user and want to restrict them to the normal path. Is there any way to restrict them from creating a file with executable privilege?

Or, more generally, is there any way to build an access control list and define that this user may only execute files in this list?

I wish to restrict access to using a GPU (in terms of reserving memory on it) for certain users on a jointly used workstation. So if a user tries to access the GPU on SSH, for example via CUDA, that request would be denied. Any ideas where to start looking for that?

Thanks in advance!