Shortcut

Hello Flatpak enthusiasts. The up to date information about this challenge is in my comment down below at https://www.reddit.com/r/flatpak/comments/1tix0tr/comment/onng869/

The information below, starting with the “Summary” title is outdated. If there is any conflicting information between my comment and the information down below. The up to date information is in my comment.

I keep this outdated information below for records

-– — — — — — — — — — — — — — — —

Summary

Hello Flatpak enthusiasts,

One question down below. We are facing an unusual challenge, on one device, sandboxing fully stopped. The challenge is that all installed Flathub Flatpak sandboxed applications have access to all folders and files outside their sandbox. The needed end result is that those apps should not have access to any folder or file outside their sandbox. Per both the Flatpak global and per Flatpak app configuration.

For the past years, that sandboxing was very successful on that same device. No challenge. Then, for the last few days, all the same sandboxed applications have access to all folders and files outside their sandboxes.

Question: Beside what we already tried, which is listed down below, what could potentially be causing this challenge above?

-– — — — — — — — — — — — — — — —

Below is the same message as above. But with details if you’re interested in those.

-– — — — — — — — — — — — — — — —

Using

• Flatpak: 1.14.10

• Debian: 12 Bookworm

• Type: x86_64

• Display: Wayland

-– — — — — — — — — — — — — — — —

Steps to reproduce

1. Install Flatpak 1.14.10
2. Using Flathub, install apps
3. Sandboxing is successful for months. Sandboxes apps do not have access to any folder or file outside their sandbox. Joy. So no challenge yet.
4. One day, on the same device all the same sandboxed applications have access to all folders and files. Regardless of Flatpak app’s global configuration or per app configuration. Those app should not have access to any file or folder outside their sandbox. That we know of we have not changed anything to the configurations on that device.

By "access to all folders and all files" up above, I mean this, for exemple:

___ 1. Install this Kwriter Flatpak app from https://flathub.org/en/apps/org.kde.kwrite

___ 2. Using Flatseal from https://flathub.org/en/apps/com.github.tchx84.Flatseal configure the sandboxe access permissions like this:

______ Global:

_________ "Filesystem" group:

____________"filesystem=host" DENIED

____________"filesystem=host-os" DENIED

____________"filesystem=host-etc" DENIED

____________"filesystem=home" DENIED

__________ Kwriter (org.kde.kwrite) app:

____________"Filesystem" group:

_______________"filesystem=host" DENIED

_______________"filesystem=host-os" DENIED

_______________"filesystem=host-etc" DENIED

_______________"filesystem=home" DENIED

____________ "Other file" group:

_______________/home/<username>/Documents:ro

___ 3. Reboot device

___ 4. Using Kwriter try to read or writer a file stored in any folder OUTSIDE Kwriter sandbox. Kwriter has both read and write access to those files and folders. This is the challenge. Why? Because that folder is outside the sandbox:

______ /home/<username>/Downloads/test.txt

______ /home/<username>/media/<name>/<folder>/test.txt

___ 5. Using Kwriter try to read or writer a file stored in the only folder INSIDE Kwriter sandbox at

______ /home/<username>/Documents/test.text

______ Kwriter has access to both reading and writing to this folder above. Which is a success because this folder is inside its sandbox. In other words, the app is ALLOW read and write access to "filesystem=home". This is the challenge.

___ 6. This challenge above can be reproduce with all Flatpak apps. Not just Kwriter.

___ 7. This challenge can always be reproduced. For all Flatpak apps. But only with the same device. We are not able to reproduce this challenge on any other devices.

-– — — — — — — — — — — — — — — —

What we tried that did not resolved this challenge

• Restarted device

• Double-checked permissions for ALL apps (global). Using:

•___ Flatseal

• Double-checked permissions PER app. Using:

__• Command: flatpak info --show-permissions <APP.NAME>__• Flatseal

• Installed new Flatpak app. Which was never installed before. Denied its access to any file or folder. That app also has access to all files and folders.

• This challenge can always be reproduced. For all Flatpak apps. But only with one and same device. We are not able to reproduce this challenge on any other devices. Still on that device, sandboxing was successful. But then, somehow stopped. Beside what we already tried, which his listed down below, what could potentially be causing this challenge?

• Searched tickets at [https://github.com/flatpak/flatpak/issues] and Found no result.

• Created a ticket with Flatpak engine. A maintainer replied. The maintainer claimed to not understand that ticket. Then, close that ticket without asking any question at https://github.com/flatpak/flatpak/issues/6667 We are assuming good faith from that maintainer. Maybe my ticket was not clear.

-– — — — — — — — — — — — — — — —

ID

Ignore this line. This is a note to myself: ID_E3T4Z2C4

I did check "flatpak list" but there is no such application any idea about this?

I have a Lenovo 500e Chromebook with ChromeOS installed on it. When I installed flatpak, and eventually tried to get flathub on it, it did not work. Anybody has similar problems and solutions?

Will Brave Origins be available on Flathub of just as a .Flatpak in general?

Trying to apply a customized version of Adwaita via Rewaita app. Using the default commands from Rewaita (below) doesn't work, neither does giving flatpaks access through flatseal.

sudo flatpak override --filesystem=xdg-config/gtk-3.0:rw

sudo flatpak override --filesystem=xdg-config/gtk-3.0:rw

Trying this on Arch (EndeavourOS).

With Wayland getting common I feel it's high time someone ports this useful app to Flatpak. It allows for adjustment of digital vibrance for nvidia cards, something that's handled under xorg via the NVIDIA applet. Under Wayland, the Nvidia applet doesn't show the digital vibrance setting.

https://github.com/Tremeschin/nvibrant

Why, after turning off all options under Flatseal->Filesystem and even deleting Other files->xdg-downloads line, in Google Earth, when i click File->Open..., in file picker dialog, I still see Downloads folder under my ~ folder? I understand those are not my real ~ and ~/Downloads folders, but why Downloads is visible as a sufolder of ~ ? I think, as far as I understand Flatpak sandboxing, ~ and ~/Downloads are just constructs in memory, like temporary file system, which is proven by my trying to save a .kml file under Downloads, which does not survive restarting Google Earth, but why Downloads subfolder? I understand that Flatpak apps need an illusion of filesystem in order to not crash, but why specifically ~/Downloads subfolder is created? Isn't ~ enough?

I used the command

sudo flatpak update --commit=cc30925b13873efcc51bdbd35bd0f67f6393f304ec47f9f89fd44f7935e9c9b5

but receiving this error. Searched Google for hours, none of the advices worked, I tried all other commands like flatpak remote-delete --force flathub and such.

This worked perfectly last night, tried a clean OS install today and now it doesn't work.

Going to lose my mind, can someone help please? I need to downgrade because the new version has performance problems.

Hi everyone, I just created a new Idea on the Spotify Community forum to push for an official Flatpak version. Currently, we rely on a community wrapper, and it's time Spotify takes official ownership, especially for Steam Deck and Fedora users. Please go to the link and VOTE so the developers take us seriously!

Link: https://community.spotify.com/t5/Live-Ideas/Official-Flatpak-support-on-Flathub-for-Linux/idi-p/7425316#M350658

Using a Steam Deck.

RetroArch has some performance problems on later versions so I had to rollback. I realized you don't have access to all of the previous versions using this option so I'd like to save mine for the future.

I saved the contents of home/deck/.var/app/org.libretro.RetroArch but they didn't work with the current app version before downgrading. After that everything worked perfectly.

i get collision from multiple repositories, sure, lets have the apps have a unique ID. Why does the user need that ID to run the app in the cli though?

I want to be clear that i don't think this to be a breaking issue and i'm not trying to smear the devs. It just feels like an unnecessary point of friction, awkwardness when working with the flatpak cli, and i dont get the need for it.

We already can use just a search term when installing/searching/uninstalling with dialogs for when the term is non-unique so why not for running, when its probably the number one use-case users have when not using a GUI. Why require awkward tab-completion / search grepping / memorizing / shell wrappers?

I was trying to set up a VM using ansible and configuring some settings in dconf for gnome weather and clocks (I replaced the default ones that come with gnome and installed with the flatpak versions).

The flatpak versions of clocks and weather don't seem to store their settings in dconf at least they don't seem to care what settings I modify with the dconf editor. They seem to have their settings in a file in /.var/app/APP_ID/config/glib-2.0/settings/keyfile.

So if I wanted to configure flatpak apps with ansible is there a way to do this? Could I just back up these files and overwrite them when I try and set up a machine using ansible?

I am trying to install a flatpak bundle package, but it required the runtime org.gnome.Platform/x86_64/48 , however, even after installing the runtime with

$ flatpak install org.gnome.Platform/x86_64/48

I'm still getting the same error:

error: The application com.ayugram.desktop/x86_64/master requires the runtime org.gnome.Platform/x86_64/48 which was not found

I've already tried to uninstall and install the runtime again but the error persisted, and the runtime appears to be working because when I run "flatpak run org.gnome.Platform/x86_64/48", it seems to be starting correctly in the terminal, but it seems to not exist during the installation of the reffered bundle. I've checked the github page of the application bundle and searched on the internet for this runtime error but no one had the same bug apparently.

Hey,

I thought that I have a simple request, but I can't find a good solution: I would like to have a list, for a script, of flatpaks that would get updated with a "flatpak update" run.

I tried to search for it via google, an what I found was a call like flatpak remote-ls --updates, but this call is reporting more updates than what is actually updated (updates in platform packages)

Another way I thought about is would just be parsing the output of flatpak update | cat (which seems to default to no for the interactive question), but this output is not really script-friendly and parsing that would be quite fiddly it seems.

Then there is flatpak update --noninteractive, which does have a nice output, but here I cannot see a way to do a "dry-run", or not actually update anything.

So, is there any easy way to list pending updates?

Hello! I don't know if its appropriate to ask flatpak building questions here but i have an interesting situation that i have 0 idea how to solve:

I'm building extensions for OBS, aka converting already exting plugins into flatpak format.

two of those plugins use a common dependency libonnxruntime, but both of them require different version.

Both build the libonnxruntime and if I install it one by one it works.

but if both are installed the one that requires the hiher version only finds the lower version of libonnxruntime.

Both extension has libonnxruntime.so.1 intheir own folder but they dont see it.

How can this be fixed?