Refine Flatpak permissions.

staniel359 / muffon

Advanced multi-source music streaming + discovery client for desktop. Free, clean, no login, no ads.

https://muffon.netlify.app

GNU Affero General Public License v3.0

1.18k stars 49 forks source link

Refine Flatpak permissions. #180

Open Lokawn opened 4 weeks ago

Lokawn commented 4 weeks ago

Refine Flatpak permissions, currently muffon flatpak asks for Read/write home directory access, which I think is not needed. Also permission to talk to system and session bus for system tray icon.
Use correct category, according to specification.

xyloflake commented 4 weeks ago

Read/Write is needed @Lokawn

@gamersi I think we both know that electron store uses the file system and needs filesystem access to the hone directory to work currently.

I would suggest one of the team members to actually try it out on a flatpak machine. Overall, I think core team should be commiting this instead of outside contributors for security purposes.

This PR is a no go for me as of now. However if @staniel359 insists, I'll approve.

staniel359 commented 4 weeks ago

@xyloflake Also I don't insist, just whatever is better for Flatpak community.

gamersi commented 4 weeks ago

Yeah, couldn't test it because of the bug mentioned in discord. I can test it when that is fixed

Lokawn commented 4 weeks ago

Read/Write is needed @Lokawn

The flatpak provided on official website does not have access to system files, only to the /home directory as mentioned in the electron builder documentation in finishArgs section.

Flatpak Documentation states that

In addition to /app and /usr, each application sandbox gets a per-app data directory mounted which persists over app upgrades. It is stored as a subdirectory of the $HOME/.var/app directory (e.g. $HOME/.var/app/org.gnome.GEdit/). The $XDG_DATA_HOME, $XDG_CONFIG_HOME and $XDG_CACHE_HOME environment variables are set to point at data/, config/ and cache/ subdirectories respectively in this location.

So a make shift Home directory is provided to every app.

If access to any other particular file is needed then it can be whitelisted using --filesystem= permission. --persist=. can be used to check for files created by the app.

xyloflake commented 4 weeks ago

As discussed on discord and as instructed by @staniel359, we've decided to keep this open for a while until we get to test it. These reviews were made without proper testing and thus they were dismissed.

@Lokawn thank you for your valuable contribution, we'll merge it ASAP but we need to test it before we merge (will take some good amount of time since we, the devs are busy as of now).