cmd/snap-confine: use /etc/ssl from the core snap

[morphis]

We need to use /etc/ssl from the core snap next to /etc/alternatives
as applications like LXD expect a correct setup of the certificate
chain which is broken if we're running snaps on non Ubuntu/Debian
distributions.

Fixes https://bugzilla.opensuse.org/show_bug.cgi?id=1028568

[zyga]

LGTM, just one comment to apply.

[zyga]

Nice, thanks!

[zyga]

I think you meant:

details: |
  The snap-confine program bind mounts the /etc directory from the classic distribution into the snap execution
  environment. Certain directories however, if they exist on the host's /etc are actually, bind-mounted from the
  core snap for a more consistent behaviour across various distributions.

[chipaca]

LGTM. One request.

[chipaca]

could you expand this comment a little bit to also link the bug this PR fixes?

[morphis]

Done.

[jdstrand]

This PR is a 6 of one half dozen of the other type of thing. This PR means that now locally installed certificates on classic won't work and there is no mechanism for extending the core snap's certificates. Debian and Ubuntu have 'update-ca-certificates' (man 8 update-ca-certificates) which can look at /usr/local/share/ca-certificates that might be used to help address this, but I don't know what mechanisms are available in other distros. I suspect more people are affected by this PR not being applied than those that will be when it is applied, but I predict bug reports.

[anlx-sw]

is there a way to persistently add root certificates to snap? i run snap on a ubuntu 16.04 server and it seems that tls certificates from an internal ca can't be verified anymore.