There also should be a portal for raw SANE access, for applications such as XSane, Skanlite or Simple Scan.It would be good for apps like VueScan (but not necessarily for VueScan itself - just for similar apps). To access raw devices, there should be portal for USB, as well as for COM, LPT and possibly other interfaces.There is no such problem in Android, but on the desktop, a lot of portals are missing. If you want to add access to the scanners, you have to provide access to the Internet! Makes sense? In the end, in typical scenario, flatpak doesn't protect you from anything. If you want to add access to the joystick, you must also give access to the camera. It is because the whole permission system is broken. You think it is pretty safe, but it is not, because it can actually access your secret data and sent it over the Internet. Then you provide access to the Internet and joystick. You give it standard permissions, but without filesystem access, apart from its own directory. Let's say you want to provide the fully sandboxed game. with root permissions), but not in Silverblue.Īnyway, the flatpak sandbox is mostly a lie. It is easy fixable in classic Fedora (all you have to do is create a symlink. Unfortunately, the snapd packages for Fedora are intentionally broken to prevent such applications from running. This is why Canonical provided the classic confinement. However, it is not suitable for every application. In Snap, this problem was partially resolved by the slots. Oh, and we have the same security problem with the -talk-name= permission. By the way, Snap doesn't have this problem at all (see: snap's home, as well as personal-files, removable-media, etc.), but you can't say something was better done by Canonical, because that would be " hate". So, for example, if you have an application without direct access to any devices and without network access, but with at least -filesystem=home, you can still use a camera, take a picture of the user and send it over the Internet. They both allow you to escape from the sandbox. We have similar amount of applications with the -filesystem=home access.įrom a security perspective, there is not much difference between the -filesystem=host and -filesystem=home. I will give you a few examples: PermissionsĪs of Jan 1, 2020, at least these applications have the -filesystem=host access: software companies (as vendors, because companies are not interested in maintaining packages on Flathub - they often chose Snapcraft instead).If you have ever criticized GNOME or Flatpak in public, you will be discriminated. If you are a GNOME member, you can do anything, break all the rules. The only thing that matters is who creates the application and who is the maintainer of the package. It doesn't matter if the software is full-value or half-working (generally speaking, almost every IDE on Flathub is broken, including Visual Studio Code, Code::Blocks, JetBrains IDEs, etc.), polished or bugged, stable or unstable, safe or with security holes (we already have packages that have literally over 100 known security vulnerabilities (already marked with CVE) and no one has done anything about it for years). They are not there to provide exemplary quality, but to discriminate one software against another. I will tell you one thing: these rules are bullshit. For example, Gimpsle was accepted with the -filesystem=host access, although yet in 2018 they said that even GIMP should have lower permissions. ![]() ![]() Moreover, new submissions are still accepted with highest privileges. Moreover, for already existing packages, " patches are welcomed". The answer was as follows: " rules are fluid and just because something has been accepted before doesn't mean it would be now". I tried to confront Flathub members why new applications cannot have such permissions. It is true that most popular software on Flathub have the highest possible access to the filesystem. I know that at least some of you are familiar with the flatkill website. As you can see, my standalone package has full permissions, but I was forbidden to give the same permissions on Flathub. They always want to limit application permissions as much as possible, at least officially.Īnyway, I got at least several dozen requests (both on GitHub and IRC channel) to remove the -filesystem=host permissions from my packages. Unfortunately, Flathub members have a different opinion on this matter. ![]() I always try to give the -filesystem=host permissions, because users expect it. Well, according to the Flathub members, it's not a bug, it's a feature. Version won't allow use of secondary drives
0 Comments
Leave a Reply.AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |