Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Filesystem access scope #153

Closed
yookoala opened this issue Oct 6, 2020 · 7 comments · Fixed by #154
Closed

Filesystem access scope #153

yookoala opened this issue Oct 6, 2020 · 7 comments · Fixed by #154

Comments

@yookoala
Copy link
Contributor

yookoala commented Oct 6, 2020 •
edited
Loading

Is there any reason why this application needs a full "home" filesystem access? If the file system access is only for downloading files, the access scope can well just be "xdg-download" (the download folder) instead of "home", right?

The Element / Riot.im flatpak package is setup this way.
yookoala added a commit to yookoala/org.signal.Signal that referenced this issue Oct 6, 2020
@yookoala
Limit the filesystem to download folder only
a73d6f0 
* Change the "--filesystem" flag from "home" to "xdg-download".
  That means Signal can only access the XDG Download folder of the
  user instead of full access to home folder.

* Resolve flathub#153.
yookoala added a commit to yookoala/org.signal.Signal that referenced this issue Oct 6, 2020
@yookoala
Limit the filesystem to download folder only
2c0d496 
* Improve sandbox security by change the "--filesystem" flag from
  "home" to "xdg-download". This means Signal can only access the
  XDG Download folder of the user instead of full access to home
  folder.

* Resolve flathub#153.
@yookoala yookoala mentioned this issue Oct 6, 2020
Merged
@bermeitinger-b
Copy link
Collaborator

The application needs access to home, so that sharing files with your contacts will stay possible.

@bermeitinger-b
Copy link
Collaborator

There seems to be a possibility to circumvent the restrictions.
#154 (comment)
I can partially verify this, however, did you look at the sent passwd file? It is the one from the sandboxed environment and not the host system.

@yookoala
Copy link
Contributor Author

Strange. I am a GNOME user and I don't experience this issue. Could this be a DE specific bug?

@yookoala
Copy link
Contributor Author

yookoala commented Oct 29, 2020 •
edited
Loading

2020-10-29 08-56-27 的螢幕擷圖

The file sharing screen for the latest version of Flatpak-installed Signal.

The Chinese folder names read:

  • 圖片 (Pictures)
  • 下載 (Downloads)
  • 桌面 (Desktop)
  • 影片 (Videos)
  • 音樂 (Musics)
  • 文件 (Documents)
  • 分享 (Shared)

Environment:

  • OS: Fedora 32
  • Flatpak: 1.8.2
  • Signal Desktop: 1.37.2 (stable, flathub)

@yookoala
Copy link
Contributor Author

yookoala commented Oct 29, 2020 •
edited
Loading

As described here:

I am unable to reproduce the issue in a virtual machine and a flesh-installed Kubuntu / KDE Neon. Both setups work perfectly normal to me. Would require more information from @Maltimore.

@Maltimore
Copy link

This issue can be closed, as @yookoala convinced me successfully that the issue must be on my end. Thanks @yookoala !

@dreua
Copy link

dreua commented Jan 17, 2021

I only see the folders "Download" and "Desktop" because I deleted the others a long time ago, never thought they would be of any use until now. Makes me wonder if @Maltimore could have deleted/renamed all of them so they don't show up.

In general I think this would be a perfect use case for the FileChooser portal. (General description of portals.)
Unfortunately I haven't used this before, has anyone experience or did some investigation whether using portals would be possible with Signal?

(Supporting drag and drop would be a dream! More info on that possibility: flatpak/xdg-desktop-portal#99)

@bermeitinger-b bermeitinger-b mentioned this issue Apr 22, 2021
Closed
@bermeitinger-b bermeitinger-b mentioned this issue Apr 4, 2022
Closed
@bermeitinger-b bermeitinger-b mentioned this issue Dec 2, 2022
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Limit the filesystem to selected xdg portals yookoala/org.signal.Signal
4 participants
@yookoala @bermeitinger-b @Maltimore @dreua