search

flathub / com.github.iwalton3.jellyfin-media-player

https://flathub.org/apps/details/com.github.iwalton3.jellyfin-media-player
GNU General Public License v3.0
1 stars 6 forks source link

Excessive permissions #67

Open ioerror opened 2 weeks ago

ioerror commented 2 weeks ago

The permissions on flathub say "User Device Access" and "Microphone Access" - these permissions appear to be unnecessary.

This line is the issue: https://github.com/flathub/com.github.iwalton3.jellyfin-media-player/blob/dca07bb429551255f9f896c05d7ed20b54791662/com.github.iwalton3.jellyfin-media-player.json#L15

Ubuntu 24.04 is impacted by the Wayland/NVIDIA issues but this allows it to run with fewer permissions and it works under wayland with the not so great NVIDIA non-free drivers:

flatpak run --device=dri --nosocket=wayland --socket=fallback-x11 com.github.iwalton3.jellyfin-media-player

Alternatively it is possible to set an override and run the flatpak without setting the arguments every time:

flatpak --user override --nodevice=all --device=dri --nosocket=wayland --socket=fallback-x11 com.github.iwalton3.jellyfin-media-player
flatpak run com.github.iwalton3.jellyfin-media-player

Note: To remove the original permissions, one needs to change the json file and rebuild, set an override, or use flatseal to change the permissions.

ioerror commented 2 weeks ago

A (potential) user was unwilling to install this software due to the permission warnings about the possible microphone and webcam access. I have opened https://github.com/flathub/com.github.iwalton3.jellyfin-media-player/pull/68 to reduce the permissions.

ioerror commented 2 weeks ago

The microphone access is likely to remain due to the required pulseaudio socket and the current permissions model of flatpak regarding audio devices. The other permission reductions are useful but there does not appear to be a way to play audio without also having the permissions to record audio with flatpak.

This related discussion seems relevant: https://github.com/flatpak/xdg-desktop-portal/discussions/1142