News for hackers. Stuff that matters.

A comment on Flatpak: A security nightmare – two years later. Parent comment

Re:Flatpak: A security nightmare – two years later by smileybarry on Friday October 02, 2020 @10:08AM (#24662746)
> They don't mention sandboxing on their frontpage, at all.

But the apps themselves still show "Sandboxed" when they aren't[1]. It's trivial for the flatpak "store" to just hide "sandboxed" if the flatpak requires access in its manifest. The Microsoft/Windows Store does this. UWP apps are sandboxed and permission-managed, but if a store app requires full access, the permissions section[2] says:

> This app can

> Access all your files, peripheral devices, apps, programs and registry

[1] See first screenshot in OP article.

[2] https://www.microsoft.com/en-us/p/microsoft-flight-simulator...

[ Parent | on HN ]
Re:Flatpak: A security nightmare – two years later by grey_earthling on Friday October 02, 2020 @10:30AM (#24662970)
That screenshot is of GNOME Software, not of a Flatpak app. GNOME Software decides how it describes apps.

The GNOME designers are working on a redesign of this area: https://gitlab.gnome.org/Teams/Design/software-mockups/-/blo...

There are other software installers that can install Flatpak apps, e.g. KDE Discover.

So this is a valid criticism of GNOME Software, but not of Flatpak.

[ Parent | on HN ]
Re:Flatpak: A security nightmare – two years later by smileybarry on Friday October 02, 2020 @11:22AM (#24663551)
You're right, I checked Plasma (Kubuntu) and it doesn't show the same "Sandboxed" indicator for Flathub. This is more of a GNOME issue, even a serious one if it existed for an whole 2 years.
[ Parent | on HN ]
Re:Flatpak: A security nightmare – two years later by knocte on Friday October 02, 2020 @11:45AM (#24663798)
Great, let's create the bug report, otherwise GNOME devs may not know about this defect.
[ Parent | on HN ]
Re:Flatpak: A security nightmare – two years later by cheph on Friday October 02, 2020 @02:39PM (#24665636)
> But the apps themselves still show "Sandboxed" when they aren't

Redefining the term and then claiming that what someone else meant by it is not in line with what you meant with it is ... well it is messed up.

They are sandboxed, but rightly Gimp has access to your whole filesystem because that is what people who install it expect.

Of the 30 apps I have installed via flatpak only 6 have access to the whole FS or my entire home directory (Zotero=home, Krita=host, KolorPaint=host, Inkscape=host, Gimp=host, Geeqie=host), and of those 6 only 1 (Zotero) of them seems like it may be fine without it.

Having access to the host FS in no way mean to me that Geeqie is not "sandboxed". It just means that what I would expect is the case. If you want to change it, go open up flatseal and change it.

[ Parent | on HN ]
Re:Flatpak: A security nightmare – two years later by smileybarry on Friday October 02, 2020 @07:01PM (#24667900)
> They are sandboxed, but rightly Gimp has access to your whole filesystem because that is what people who install it expect.

They can be sandboxed, but that doesn't mean every Flatpak package should be labelled "Sandboxed". Especially if said app isn't actually sandboxed and has full filesystem access.

[ Parent | on HN ]