(not sure this is exactly how it's supposed to be done - but the result was good...)
....
root@bananapim2plus:/home/dhoward# snap list
Name Version Rev Developer Notes
core 16.04.1 645 canonical -
hello-world 6.3 27 canonical -
root@bananapim2plus:/home/dhoward# /snap/bin/hello-world
Hello World!
root@bananapim2plus:/home/dhoward# /snap/bin/hello-world.evil
Hello Evil World!
This example demonstrates the app confinement
You should see a permission denied error next