Open rusty-snake opened 2 years ago
Flatpaks can not call syscalls like unshare, mount, chroot/pivot_root which are essential to setup a namespace based sandbox. This means flatpaks can not directly sub-sandbox it self and need to use flatpak-spawn instead.
unshare
mount
chroot
pivot_root
flatpak-spawn
The most chrom* and electron flatpaks use zypack to redirect the chrome-sandbox to flatpak-spawn. AFAIUI this means that the "good" chrome sandbox is replaced by the "weak" flatpak sandbox.
Should there be an "If you install chromium via flatpak the sandbox ..." note or do I understand things wrong?
Flatpaks can not call syscalls like
unshare,mount,chroot/pivot_rootwhich are essential to setup a namespace based sandbox. This means flatpaks can not directly sub-sandbox it self and need to useflatpak-spawninstead.The most chrom* and electron flatpaks use zypack to redirect the chrome-sandbox to
flatpak-spawn. AFAIUI this means that the "good" chrome sandbox is replaced by the "weak" flatpak sandbox.Should there be an "If you install chromium via flatpak the sandbox ..." note or do I understand things wrong?