Network permission missing?

[mttkay]

I am not familiar with flatpak internals, but I noticed that I cannot import new formats from a remote destination in the flatpak version of Twine; it fails with the following error:

The URL is taken from https://github.com/lazerwalker/twison, and I can curl it from my host machine successfully:

https://lazerwalker.com/twison/format.js

So I wondered whether this could be a permission error due to flatpaks running in containers (IIUC). I checked the app permissions:

[9:59:37] ~ flatpak info --show-permissions org.twinery.Twine      
[Context]
shared=ipc;
sockets=x11;
devices=dri;
filesystems=xdg-download;xdg-documents/Twine:create;

According to https://docs.flatpak.org/en/latest/sandbox-permissions-reference.html, this is missing the network permission:

--share=network | Access the network [2]

I tried to experiment with this by doing

[9:57:02] ~ sudo flatpak override com.twinery.Twine --share=network

but this seems to have no effect.

Any ideas what's going on here?

[mttkay]

Yeah pretty sure that's the problem; looking at permissions for Slack, for instance:

[Context]
shared=network;ipc;
...

same for Dropbox and other networked apps.

[mttkay]

A workaround is to first download the remote format to a local file on your host machine, then use a file:// URL in the import dialog.

But I would still consider this a bug, since it breaks existing functionality.

[hfiguiere]

You can use Flatseal to enable it in the mean time.

https://flathub.org/apps/details/com.github.tchx84.Flatseal

[mttkay]

Thanks for pointing this out, I was not aware of it; this looks really useful :+1:

[SISheogorath]

Sorry for being late to the party, I didn't watch the repository 🤦🏻

Anyway, it was an intentional decision to no provide network access, but I can see why it's useful. Therefore let's go with it, people can restrict network access down the line.