ARarghwhat·Apr 17, 2021
Examples of popular apps that can write to the host filesystem (and remember kids, the ability to write to $HOME always means full account takeover, followed shortly by root access if your account can sudo):
- vs code (https://github.com/flathub/com.visualstudio.code/blob/91e589...)
- chromium (https://github.com/flathub/org.chromium.Chromium/blob/1edd4a...)
- sublime text (https://github.com/flathub/com.sublimetext.three/blob/d1f617...)
- obs studio (https://github.com/flathub/com.obsproject.Studio/blob/051f6f...)
The applications above also provide other dangerous privileges, but they pale in the presence of filesystem access.
Examples of applications that have full device access (which is considered insecure and called "not ideal" in the flatpak docs), as well as sharing a bunch of namespaces like network and IPC (meaning these parts a
Read the rest
re not sandboxed):
- discord (https://github.com/flathub/com.discordapp.Discord/blob/maste...)
- steam (https://github.com/flathub/com.valvesoftware.Steam/blob/beta...)
- telegram (https://github.com/flathub/org.telegram.desktop/blob/beta/or...)
- lutris (https://github.com/flathub/net.lutris.Lutris/blob/beta/net.l...)
Of all the applications I sampled (some by popularity, some random I knew), all gave full device access and disabled network/ipc sandboxing. A significant chunk gave filesystem=host access (not even home, host!).
(I am however happy to see that the number of filesystem=home/filesystem=host manifests seem to have dropped.)
> The fact that you're suggesting two separate technologies in combination confirms this, in my opinion.
Whenever independent tasks need to be accomplished, independent solutions is the superior choice. The alternative are monoliths and semi-closed gardens.