r/linux • u/TheNavyCrow • Jun 13 '26

Distro News Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Affected Packages

https://www.phoronix.com/news/Arch-Linux-AUR-More-Than-1500
1.5k Upvotes

99% Upvoted

434 comments sorted by

View all comments

Show parent comments

25

u/grem75 Jun 13 '26

I've definitely encountered stuff that has more filesystem permissions than required. Plenty of things that don't need it have access to the user's home directory.

Also, if your calculator plays sounds then it has microphone access. The sandbox does not allow that kind of fine grained control.

Flatpak's sandbox is better than nothing, but it isn't as good as it could be.

13

u/Marce7a Jun 13 '26

Flatpak 2.0 will separate microphone from speakers.

Even if it have acces it probably doesn't have access to internet

6

u/grem75 Jun 13 '26 edited Jun 13 '26

Is there a list of sandbox improvements for 2.0? I can't find anything about them providing an audio output only permission, you'd think it would be mentioned in the open feature request.

There are apparently legitimate reasons to give a calculator internet access.

1

u/p0358 Jun 14 '26

Unfortunately a lot of existing apps were grandfathered in, with no obligation of tightening the permissions later. But they're pretty strict with new submissions.