Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove flatpak filesystem permissions #460

Merged
merged 4 commits into from
Aug 12, 2021

Conversation

sonnyp
Copy link
Contributor

@sonnyp sonnyp commented Aug 11, 2021

Fixes #413

I found several issues with hardcoded paths so I will end a PR for that after.

@sonnyp sonnyp force-pushed the flatpak-permissions branch from c42bd1c to 7c85906 Compare August 11, 2021 22:50
@sonnyp sonnyp marked this pull request as ready for review August 11, 2021 22:52
Copy link
Member

@mirkobrombin mirkobrombin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

image
the only "problem" I found is with wine not being able to open or save files from/in any path due to the new permissions

@mirkobrombin
Copy link
Member

I think the second point is the better choice but should be implemented only for flatpak users as other packages has not these restrictions: #413 (comment)

@sonnyp
Copy link
Contributor Author

sonnyp commented Aug 12, 2021

@mirkobrombin so you mean

Remove all filesystem permissions and instruct users to use Flatseal if they need a permission for a Windows app

How do you feel about instructions in the README.md of the Flathub Bottles repository for now?

@mirkobrombin
Copy link
Member

mirkobrombin commented Aug 12, 2021

That may be fine but most users won't reach that repository. Perhaps it is better to at least allow access to the home folder. What do you think?

I don't like the idea of ​​exposing the home but I'm afraid no user will appreciate this change and maybe it's too difficult to find that information.

@mirkobrombin
Copy link
Member

Maybe the third option is the best

Let users pick folders (via the portal) which are exposed to a Bottle via a symbolic link in the wine prefix (is that even possible?)

With a simple tutorial the user will be introduced to the new feature.

@sonnyp
Copy link
Contributor Author

sonnyp commented Aug 12, 2021

Nah, either we say "sandboxed" and we provide a way for users to punch holes at will. Or we say "Bottles needs fs" in which case we might as well leave gvfs, /run/media and so on.

I'm strongly in favor of the first even if it's more work. If users don't care about sandboxing they can use AppImage, Snap, distribution package, ...

What about we show a "Give filesystem access" button in the bottle to flatpak users that opens the documentation on how to for now?

Later (no promises) I would like to investigate into using the documen portal for this. There is a persistent option https://github.com/flatpak/xdg-desktop-portal/blob/89d2197002f164d02d891c530dcaa2808f27f593/data/org.freedesktop.portal.Documents.xml#L73

Related: flatpak/xdg-desktop-portal#133

@mirkobrombin
Copy link
Member

Yes, I think it's a good idea to add the button.

@mirkobrombin
Copy link
Member

We should merge and open a new issue for button documentation. Is it ok?

Co-authored-by: Sonny Piers <[email protected]>
@sonnyp
Copy link
Contributor Author

sonnyp commented Aug 12, 2021

Yes, please go ahead. I will take care of creating the issue - I want to give it some thoughts with a concrete proposal, and it's tracked in #413 anyway.

@mirkobrombin mirkobrombin merged commit 4fc4eb6 into bottlesdevs:master Aug 12, 2021
@sonnyp sonnyp deleted the flatpak-permissions branch August 12, 2021 10:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Flatpak] Reduce filesystem permissions
2 participants