Go to flathub and check the permission of the application that you want to install. Normally they won't have access to root directory, but could access your home dir. If they had any malicious intent, they could mess with your personal files.
I think there is another application that can restrict the permission scope on flathub itself.
this post was submitted on 23 Oct 2024
54 points (100.0% liked)
Linux
1259 readers
84 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 5 years ago
MODERATORS
Also flatpaks are moving away from file system permissions towards portals. Though currently I wouldn’t see flatpak as much of a security measure.
Yeah but OP has a point regarding the libraries with known vulnerabilities. What if one of them gets exploited that allows remote malicious code execution and gives root access? I dunno how far the sandboxing goes in that regard.
The sandboxing is almost always better because it's an extra layer.
Even if you gain root inside the container, you're not necessarily even root on the host. So you have to exploit some software that has a known vulnerable library, trigger that in that single application that uses this particular library version, root or escape the container, and then root the host too.
The most likely outcome is it messes up your home folder and anything your user have access to, but more likely less.
Also, something with a known vulnerability doesn't mean it's triggerable. If you use say, a zip library and only use it to decompress your own assets, then it doesn't matter what bugs it has, it will only ever decompress that one known good zip file. It's only a problem if untrusted files gets involved that you can trick the user in causing them to be opened and trigger the exploit.
It's not ideal to have outdated dependencies, but the sandboxing helps a lot, and the fact only a few apps have known vulnerable libraries further reduces the attack surface. You start having to chain a lot of exploits to do anything meaningful, and at that point you target those kind of efforts to bigger more valuable targets.
The sandboxing isn't as much as, say, Docker containers. So I think access to memory and devices is still possible and can eventually get you access to the whole system. I would think.
And this isn't limited to flatpaks but I would assume Snaps as well, which some software is now delivered in that format by Canonical, even for server software.
That's interesting. I'll have to look deeper into that
Docker is actually less secure from a sandboxing perspective as the docker daemon runs as root.
It would make more sense to compare to raw bubblewrap or podman.
Most flatpaks don't have full access. You can grant permission via the file picker. (It happens automatically)
There are vulnerabilities found in Flatpak's sandboxing all the time so it's pretty much broken. The opening speed on HDD systems is really really bad too. That's why I only use Flatpak to install software that's not available in my distro's repos. Though I use Arch (btw) so distro packages being old isn't an issue for me.
It's still better than no sandbox at all, isn't it? And who installs their OS on an HDD in 2024?
It's still better than no sandbox at all, isn't it?
I guess so.
And who installs their OS on an HDD in 2024?
Those who earn less than $5k a month (aka 80+% of people in the world).
Nearly all of my friends make less than $5k per month, and all of them have SSDs as the boot drive in their computer.
Yes. 1TB SSDs can be bought new for 50€, 500GB for even less. For some people this is expensive depending in the region (e.g. I also know someone who uses an HDD). But given the price of other pc parts it isn't something to cheap out on (a 1TB/2TB HDD is also 50€).
Do you have current proof that there is security problems in the current stable version of Flatpak? Nothings perfect but bubblewrap should be pretty solid.
Well the sandboxing does help with trustworthy browsers so the websites can't have excessive permissions. But relying on such a broken system isn't a very good idea imo.
Sandboxing in the browser is different than the sandboxing done by flatpak.
You really want your browser sandbox to be rock solid as any weakness allows for drive by attacks by websites.
Flatpak uses bubblewrap under the hood so it is just as secure. Flatpak also has a security tracker and when security issues are found they are taken very seriously.
I see that it can be slower because of having all the dependencies included with the flatpak itself instead of relying solely on whats installed on the system.
No. Packing its own libraries wouldn’t make it slower. If anything it would be the extra access checks added by the sandbox (which is optional FWIW, apps don’t have to use it). I haven’t ever used Flatpak but I would assume the sandbox impact is minimal if at all noticeable.
There aren't any "extra access checks" to my knowledge. It's just the same regular access checks applied to a different set of circumstances.
It is a container so any access to the outside system is passed though.
There are XDG portals but those are just standard ways of accessing a resource.
It's not securely sandboxed like a Qube, but apps can have their permission to access files and such restricted. Malware can escape the sandbox, or apps may come with very permissive permissions.
Also the sandbox won't prevent social engineering
Flatpak does NOT provide sandboxing. It containerises your applications. It's better for permission management but by no means makes the system invulnerable to malware.
I don't think speed is an issue. They're larger but all software loads dependencies from disk, flatpaks just have them bundled into a different location.
Snap did have some loading time issues but in terms of performance, I don't think there was much measurable difference.
Ohai, let's load our own individual copy of everything separately. Since - we hope - it's all bult from pristine sources and unlikely to match versions, all that static code load isn't shared with anything else.
It's gonna load slower, take up buckets of space, and not care whether it's some crusty old thing with sploits aplenty.
I miss when we had mentors to remind us not only How to be better, but also Why. My mentor was like if obi-wan was born in Dublin. His sarcasm cut deep if you could parse what he was saying.
The flatpak sandbox shouldn't be considered secure against malware. It is more of a loose sandbox.
It is technically possible for a flatpak to ship a insecure library. However, that's not unique to flatpak and I've never actually heard of that happening (I'm sure it had)
Quick reminder: because flatpak hides your installation state from the system, part of flatpaks could be wildly out of date or toxic releases and your system will.not.care nor even show you anything about it.
Enterprise tools - or normal stuff that acts like them - that check remotely what you have installed and let you know you're potentially out of date (like tenable but not junk) will not learn anything about flatpak content.
Good luck. Every good thing about enterprise packaging is thrown out the window. Flatpaks are toxic.
Linux users will do anything to avoid using an honest-to-god command-line package manager.