This error occurs when Git installed via snap cannot access your working directory due to snap's strict sandboxing. Snap packages have limited filesystem access by default, and certain directories require explicit permission grants or alternative installation methods.
When you install Git using Ubuntu's snap package manager, the application runs inside a security sandbox called "strict confinement." This sandbox restricts Git's access to the filesystem for security purposes, preventing it from reading or writing to directories outside its allowed scope. The snap confinement system uses a combination of AppArmor, seccomp, mount namespaces, and cgroups to isolate applications. By default, snap applications can only access: - Their own installation directory - Non-hidden files in your home directory (requires the `home` interface to be connected) - Removable media (only when the `removable-media` interface is connected) When Git tries to access a directory that falls outside these boundaries—such as hidden directories, mounted drives, `/tmp`, `/mnt`, or non-standard home directory paths—the snap sandbox blocks the access and Git reports this permission denied error. This is a security feature, not a bug. However, it can be frustrating when you legitimately need Git to access these locations for your development work.
First, confirm that your Git installation is from snap:
# Check if git is a snap package
which git
# If output is /snap/bin/git, it's a snap installation
# Or check directly
snap list gitIf Git is installed via apt (/usr/bin/git), this error has a different cause—see related errors for other permission issues.
The most common fix is to ensure the home interface is connected, granting Git access to your home directory:
# Check current interface connections
snap connections git
# Connect the home interface
sudo snap connect git:home :homeAfter connecting, verify the connection:
snap connections git
# Should show: home git:home :home -Note: The home interface only grants access to non-hidden files. If you need access to .git directories or .gitconfig, additional steps may be needed.
If you're working on mounted drives, USB storage, or network shares (typically under /mnt or /media), connect the removable-media interface:
# Connect removable-media interface
sudo snap connect git:removable-media :removable-media
# Verify the connection
snap connections gitThis grants Git access to:
- /media - automounted removable storage
- /mnt - manually mounted filesystems
- /run/media - runtime media mounts
If your home directory uses a non-standard path (common with domain/LDAP users like /home/MYDOMAIN/username), you need to update AppArmor's home directory configuration:
# Edit the AppArmor home tunables
sudo nano /etc/apparmor.d/tunables/home.d/ubuntu
# Add your domain path (create file if it doesn't exist)
@{HOMEDIRS}+=/home/MYDOMAIN/Then restart the necessary services:
sudo systemctl restart apparmor
sudo systemctl restart snapdReplace MYDOMAIN with your actual domain or directory name.
If you frequently work outside the snap sandbox boundaries, the simplest solution is to use apt-installed Git instead:
# Remove snap version
sudo snap remove git
# Install via apt
sudo apt update
sudo apt install git
# Verify installation
git --version
which git
# Should show /usr/bin/gitThe apt-installed Git runs without confinement and can access any directory your user has permission to access. This is generally recommended for development work where you need maximum filesystem flexibility.
Some snaps offer a "classic" confinement mode that removes sandbox restrictions. Check if Git supports this:
# Try installing with classic confinement
sudo snap install git --classicNote: As of current snap store policies, the main Git snap may not support classic confinement. If this command fails, use the apt installation method instead.
Classic confinement effectively gives the snap full system access, similar to traditional packages.
After applying your chosen fix, test Git in the previously failing directory:
# Navigate to the problematic directory
cd /path/to/your/directory
# Test basic Git commands
git status
git log --oneline -5
# If cloning, test that too
git clone https://github.com/example/repo.git test-repoIf you still see permission errors, check which interfaces are connected:
snap connections gitAnd verify your current user can access the directory:
ls -la /path/to/your/directory### Understanding Snap Confinement Levels
Snap packages can have three confinement levels:
1. Strict (default): Full sandbox with explicit interface permissions required
2. Classic: No sandbox, full system access (requires Store approval)
3. Devmode: Development mode with relaxed restrictions (not for production)
The Git snap uses strict confinement for security, which is why permission issues arise.
### Available Interfaces for Git
Check all available interfaces for Git:
snap connections git --allCommon interfaces that may help:
- home: Access to non-hidden files in $HOME
- removable-media: Access to /mnt, /media, /run/media
- ssh-keys: Access to SSH keys for remote operations
- gpg-keys: Access to GPG keys for signed commits
- personal-files: Access to specific hidden files (requires special approval)
### Why Hidden Files Are Restricted
The home interface intentionally excludes hidden files (those starting with .) because these often contain sensitive data like credentials, SSH keys, and application secrets. Accessing them requires the personal-files interface, which needs explicit approval from the Snap Store.
For Git specifically, this means the snap may have trouble accessing:
- ~/.gitconfig - Git configuration
- ~/.ssh - SSH keys for authentication
- ~/.gnupg - GPG keys for signing
This is a significant limitation for development workflows.
### When to Use Snap vs Apt for Git
Use apt-installed Git when:
- You need access to mounted drives or network shares
- You work with hidden directories
- You have a non-standard home directory
- You need maximum compatibility with your workflow
Use snap-installed Git when:
- You want automatic updates
- You need a newer Git version than apt provides
- You're on a system where apt is not available
- Security isolation is a priority
### Debugging AppArmor Denials
If you want to see exactly what AppArmor is blocking:
# View recent AppArmor denials
sudo dmesg | grep -i apparmor | tail -20
# Or check the audit log
sudo journalctl -k | grep -i deniedThis can help identify which specific paths or operations are being blocked.
kex_exchange_identification: Connection closed by remote host
Connection closed by remote host when connecting to Git server
fatal: unable to access: Proxy auto-configuration failed
How to fix 'Proxy auto-configuration failed' in Git
fatal: unable to access: Authentication failed (proxy requires basic auth)
How to fix 'Authentication failed (proxy requires basic auth)' in Git
fatal: unable to access: no_proxy configuration not working
How to fix 'no_proxy configuration not working' in Git
fatal: unable to read tree object in treeless clone
How to fix 'unable to read tree object in treeless clone' in Git