search

flathub / org.gnome.Evince

https://flathub.org/apps/details/org.gnome.Evince
2 stars 15 forks source link

Remove access to whole filesystem #92

Closed rugk closed 1 year ago

rugk commented 2 years ago

Minimizing permissions is always a good idea. Why do you now need access to all files? Is not the idea that exploits or so in a PDF viewer could be mitigated/not have such a bad effect if it does not have access to all files?

The filesystem=host permission got copied from upstream/Flathub https://github.com/flathub/org.gnome.Evince/blob/master/org.gnome.Evince.json#L13 It seems that revoking that permission doesn't cause any problem with the app's main functionality.

https://bugzilla.redhat.com/show_bug.cgi?id=2098179

Ref upstream also did not explain why/how this permission would be needed: https://gitlab.gnome.org/GNOME/evince/-/issues/1810

Fixes https://github.com/flathub/org.gnome.Evince/issues/76

flathubbot commented 2 years ago

Started test build 99575

rugk commented 2 years ago

Ah just saw https://github.com/flathub/org.gnome.Evince/issues/76, anyway I see no big open issue there preventing this.

flathubbot commented 2 years ago

Build 99575 successful To test this build, install it from the testing repository:

flatpak install --user https://dl.flathub.org/build-repo/97304/org.gnome.Evince.flatpakref
Mikenux commented 2 years ago

Ah just saw #76, anyway I see no big open issue there preventing this.

If you read it, you will find this comment: https://github.com/flathub/org.gnome.Evince/issues/76#issuecomment-1075562754

Also, there are other PRs for this: https://github.com/flathub/org.gnome.Evince/pull/61 and https://github.com/flathub/org.gnome.Evince/pull/88.

There is also another issue: see https://github.com/flatpak/xdg-desktop-portal/issues/807 and https://gitlab.gnome.org/GNOME/libdazzle/-/issues/65

gpoo commented 1 year ago

Thanks for the patch. I merged #88 instead.