If you haven’t tried Ubuntu’s ‘Permission Prompting’ feature for a while, there’s more reason to do so in the latest release.

Canonical’s Oliver Calder has shared an update on recent improvements to the security feature, which sets out to “empower users” by letting them decide what software can access on the rest of the system at runtime rather than retrospectively.

Android or iOS show similar prompts, with screen modals asking if you want to “allow Acme App to access the camera” and similar.

Ubuntu’s app prompting effort is still an ‘experimental’ feature in 26.04 LTS, but is now said to be less naggy and provides greater control over app permissions. The plan is to “continue to add functionality and refinement over the coming cycles” – ergo, it isn’t done yet.

Ubuntu uses AppArmor to handle app permissions for Snaps (and Deb packages), with available permissions defined in a profile. If there is no rule allowing a particular operation, AppArmor intercepts and blocks that operation at runtime.

Calder says there’s work to “upstream the prompting kernel features from Ubuntu” to the mainline kernel, so that this could work elsewhere.

“By default, snaps have access to their own sandbox and a minimal set of system resources from the host system. However, many applications need broader permissions in order to function as intended”, Calder explains.

Typically, Snaps are able to connect to standard ‘interfaces‘, like home for files and folders, or camera for the web cam, and so on automatically. Prompting means a user has to explicitly grant permissions, rather than it being given automatically.

“If an application tries to access a resource allowed by that interface, rather than automatically allowing that access, the user is instead presented with a prompt describing the access attempt and asking whether they would like to allow or deny that access”.

This, Calder says, gives users “an extra level of control and peace of mind about the permissions of applications running on their system”. They can allow or deny a request, for how long and in some instances even define specific folder paths for access.

So rather than an image editor being able to open all files in ~/Pictures and sub-folders, you could contain it to just ~/Pictures/MySpecialFolder.

The prompting client then sends the reply back to snapd, snapd creates a new rule to allow or deny the same request in future and sends its response back to AppArmor. AppArmor receives the response and allows or denies the pending operation.

All that happens quickly.

Plus, as before, snap permissions can be managed and changed from the command-line or the desktop Security Center (if you go to Settings > Applications it mentions snap permissions are controlled elsewhere).

The user selects whether they want to allow or deny the request, the particular permissions they wish to allow or deny, how long they want that decision to apply, and (for some interfaces) the specific path(s) for which the decision should apply.

What’s changed?

Ubuntu’s Prompting client works (technically that’s a package within the wider effort, but the ‘what is the prompting-client snap in App Center for?’ queries refer to it as such), has quietly improved since its was added in Ubuntu 24.10.

Ubuntu 25.10 saw the frequency of repeated prompts reduced, included support for temporary rules that expire when you log out and extended prompting to cover the camera interface.

Ubuntu 26.04 LTS has a redesign dialogs and support for the audio-record interface, which apps can request to listen to or record audio, most commonly from a configured microphone. That required “clever changes” to WirePlumber to work, says Calder.

Since all of this work is distributed as a snap, and snaps update independently of the rest of the system, all of the improvements are available to users on Ubuntu 24.04 LTS and Ubuntu 25.10, in addition to being available in Ubuntu 26.04 LTS.

Ubuntu 24.04 LTS users do need to install the security-center snap first though, as it’s the app you open to slide the switch to enable Permission Prompting.

You will only see prompts from Snap applications. Some Debs are managed via AppArmor, while Flatpak software use XDG Portals to define and control permissions – which can be controlled through Settings > Applications.