Application Flatpak permissons in system settings

[brownphotographic]

As flatpak apps are gaining popularity, it would be nice to have flatpak application permissions in the system settings to allow the user a simple means of letting the app access various parts of the system. Rather than having to install flatpak and manually entering strings of paths, it would be better for the average user to allow them to do the following:

• Per application settings, or global settings for all flatpak apps
• Allow app access to specific folders
• Allow app to access other apps. e.g if one wants to let shotwell flatpak app access to GIMP and RawTherapee to load an image in those apps. Perhaps this would be under a global setting 'allow apps to launch other apps' or something like that.
• etc

Currently it is far too difficult for the average user to let a sandboxed flatpak app to do basic things. Rather than having to get into the weeds and use command line or a third party app, it would be more logical to let the user do basic app permissioning. This is similar to how Android apps work in Android OS where apps are initially sandboxed, but user is prompted by the OS when a permission isn't available, and also the user can go to a central place for apps and give the app specific permissions.

Such a tool is available in Elementary. See https://github.com/elementary/switchboard-plug-applications/blob/master/data/screenshot-permissions.png

[MikeNavy]

Hi,
Flatseal, itself a flatpak application (com.github.tchx84.Flatseal) allows to easily change flatpak applications permissions, with a graphical interface.

Regards,
MN

[Secret-chest]

But it uses libadwaita. Maybe LM could fork the last GTK3 release.

[mtwebster]

Flatseal is the answer here. I doubt many Mint users need or want to fine-tune their Flatpak permissions - using Flatpaks almost since their inception, I've never had a need. Elementary may have additional reasons for having their own implementation than just 'because'. Do 'snap' packages have a similar permission system? Maybe it makes more sense if you're supporting multiple sandboxed app standards.

Any Gnome app using libadwaita is going to look different now, there's nothing we can do about it, other than apply light/dark preferences consistently.

There is improved Flatpak integration with Cinnamon's privacy/lockdown permissions as well now.

[brownphotographic]

@mtwebster
So I politely disagree:

1. For the use case of allowing an app to access other apps installed, then flatpaks do not allow this by default. As explained in my opener, the flatpaks I use don't have a way of seeing other flatpaks in the system. I have to download a third party app 'Flatseal' to give a flatpak such basic permissions. Two examples are digikam and shotwell. Those two apps allow files to be opened in other apps. If I use the Ubuntu apps (not flatpaks) the apps can see any other app in the system (works as intended). If I use the flatpak versions of the same app I cannot see any other app in the system (does not work as intended). So this is a flatpak sandbox issue.
2. To me I really think that the OS should allow a user to give apps the permissions they need. Just like Android, by default apps are sandbox. They ask for permissions that they need to function properly e.g. files, Location, camera, microphone and the user has to then assign those permissions. What makes it simple is that the use is informed about what the app needs, and then they can easily make those changes by just accepting. With Mint (and many other distros), the user is experience goes as follows:

• user installs flatpak app
• user tries to do something that would just normally work in the distro packaged app
• user is met with non working functionality and scratches head
• user goes onto various forums to ask why it doesnt work
• user is informed that flatpaks sandbox apps and they have to go install flatseal
• user installs flatseal, tries app again. Settings still dont work as intended.
• user gives up and tries a different kind of app.

@MikeNavy yes I'm aware of flathead and use it. However I find it lacking the ability to easily let apps get the settings they need to just work as intended. See above.

So in summary flatpaks don't just work out of the box, and the OS doesn't help the user solve the sandboxing issues. In my mind, in order to make flatpaks more user friendly the OS should just provide some simple tools to give flatpak apps the basics they need to work.

[MikeNavy]

Hi,

Flatpak applications are isolated from the system, and from other flatpak applications: a flatpak app cannot see the other flatpak installations in "/var/lib/flatpak"; "var" is a reserved flatpak word (see flatpak documentation).

However, ".var" is not a reserved word, and a flatpak application can access the configuration directory , in "~/.var/app", of other flatpak applications, with the corresponding permission set by Flatseal or set in the code.

An example: I use FreeFileSync flatpak; FreeFileSync is a backup utility, mainly intended to backup user home files. In my home files I have all the configuration directories of my flatpak applications, including Thunderbird one with all my mails. FreeFileSync flatpak can now back up and restore these directories, since the permission "~/.var/app" has been added in its code (formerly, I had to add this permission using Flatseal):

Regards,

MN

[brownphotographic]

Thanks @MikeNavy

Yes this all makes sense. Personally I tried the above but it still doesn't work for Shotwell. I will contact the developers for shotwell and see what they say.

@mtwebster Regarding the point for the thread (which is now closed, but I really don't think it should be):

• I (a relatively technical user) can go fish on the web for specifically which string to enter into flatseal (a third party tool) to allow apps to see other apps installed in the OS, and access parts of my filesystem (e.g. pictures folder).
• Other users (including me) would probably prefer a model where either:
  a) Most helpful: per Android model apps advertise what they need for OS permissions when they launch (if they don't have the permissions) with a modal / popup window. The Settings > Applications panel for that app (which would be in the OS settings) would open, and the user clicks on what they were told to enable. App now works.
  b) Still helpful, but requires more knowledge: Apps don't broadcast what they need, but user goes fishing on the web for what they need to enable, and then goes into Settings > Applications panel to enable them. App now works.

I really do think something like the above would reduce the friction required for users to get apps to work in a Linux based OS. Today there's too much of a hurdle to overcome, and the users you don't hear about just gave up and tried something else (e.g. just went back to Mac OS or Windows because they couldn't get apps to work).

[brownphotographic]

The same discussion on gnome

https://discourse.gnome.org/t/gnome-application-settings-should-include-flatpak-permissions/12359

[MikeNavy]

Hi,

Yes, flatpak sandboxes apps! It is not just another way to deliver applications...

As a sandboxing application, it limits what users can do with a flatpaked application. The way it works is well described in its documentation, see https://docs.flatpak.org/en/latest/.

Flatseal is in accordance with the way flatpaks work: it is just a GUI allowing to easily change the way a flatpak application works. Of course, it does not allow doing something prevented by the sandbox.

You can read a flatpak tutorial here: https://forums.linuxmint.com/viewtopic.php?f=42&t=368501; or here: https://forums.linuxmint.com/viewtopic.php?t=397740 (download the guide, and read the flatpak tutorial in one of the annexes).

Very often, applications are not flatpaked by their authors, but by independent developers that take the source or the executable from the author website and just flatpak the app. This may explain why you find flatpaked applications with some functions of the original application not working: it may come for the settings (and can be corrected with Flatseal) or come from the sandboxing (and cannot be corrected).
An example: FreeFileSync can also backup system files, but whatever the settings, flatpak FreeFileSync will never backup the files in "/var/lib/flatpak/" except the ones in its own directory "/var/lib/flatpak/app/org.freefilesync.FreeFileSync/". Flatpak FreeFileSync does not have all the functions of original FreeFileSync. A user unhappy with this should use the original application, not the flatpak sandboxed one.

Regards,

MN

[brownphotographic]

Thanks @MikeNavy for the detail, and the link to the tutorial!