Flatpak filesystem permissions

[faandg]

Hi there, I was just reviewing flatpak permissions of ProtonUp-Qt.
Most of the specified filesystem permissions make sense to me except a couple (which is why I started looking a bit more closely) and I just wanted to share my feedback.

        "--filesystem=~/.config",

.config seems relatively "open" as many other applications create folders there as well.
I haven't gone through all of the code but at a glance it looks like it could be scoped to ~/.config/steamtinkerlaunch ?

        "--filesystem=~/.bashrc",
        "--filesystem=~/.zshrc",
        "--filesystem=~/.kshrc",

This is more personal preference maybe but I don't really like applications editing these particular files to add their own entries.
It looks like the *rc references are used for adding/removing steamtinkerlaunch to the PATH.
I will probably never use ProtonUp-Qt for anything other than installing or updating proton so for my particular case I can remove the permissions without breaking anything.
I understand why it might be necessary for compatibility with OStree systems though.

[DavidoTek]

Hi, good you mention this.
It is a bit of a compromise between security and comfort.

"--filesystem=~/.config",

It's used for various things, like the Lutris config, Heroic games Launcher, Fish shell variables and Steam Tinker Launch.
In theority it would be possible to add all these folders one by one.

"--filesystem=~/.bashrc",
"--filesystem=~/.zshrc",
"--filesystem=~/.kshrc",

We thought of those files to. They are only used for Steam Tinker Launch, but are mandatory for it.

"--talk-name=org.freedesktop.Flatpak"

Some compatibility tools also require running code on the host, so even if it would not have access to the above folders, it still could edit them.

[faandg]

it's used for various things, like the Lutris config, Heroic games Launcher, Fish shell variables and Steam Tinker Launch.
In theority it would be possible to add all these folders one by one.

I would prefer it that way, but again that's personal preference.

Given it's not an oversight and you thought it through and accept the risk, it looks like there is nothing further I can add :)
It's unfortunate you need to add all these permissions just in case someone wants to use STL and you can't optionally request them to the user at that time.

[DavidoTek]

you can't optionally request them to the user at that time.

Yes, that would be good if you could set optional permissions and Flatpak would ask the user (on first launch), whether they want to allow them.
There are some issues for Flatpak on GitHub regarding this, but some of them are closed as they can utilize xdg-portals instead, but that would work in our case (see flatpak/xdg-desktop-portal#674).

I will close this issue for now. If there are any news on what can be improved, we can reopen it again.