Hello Flatpak enthusiasts,

One question down below. We are facing an unusual challenge, on one device, sandboxing fully stopped. The challenge is that all installed Flathub Flatpak sandboxed applications have access to all folders and files outside their sandbox. The needed end result is that those apps should not have access to any folder or file outside their sandbox. Per both the Flatpak global and per Flatpak app configuration.

For the past years, that sandboxing was very successful on that same device. No challenge. Then, for the last few days, all the same sandboxed applications have access to all folders and files outside their sandboxes.

Question: Beside what we already tried, which is listed down below, what could potentially be causing this challenge above?

-– — — — — — — — — — — — — — — —

Below is the same message as above. But with details if you’re interested in those.

-– — — — — — — — — — — — — — — —

Using

• Flatpak: 1.14.10

• Debian: 12 Bookworm

• Type: x86_64

• Display: Wayland

-– — — — — — — — — — — — — — — —

Steps to reproduce

1. Install Flatpak 1.14.10

2. Using Flathub, install apps

3. Sandboxing is successful for months. Sandboxes apps do not have access to any folder or file outside their sandbox. Joy. So no challenge yet.

4. One day, on the same device all the same sandboxed applications have access to all folders and files. Regardless of Flatpak app’s global configuration or per app configuration. Those app should not have access to any file or folder outside their sandbox. That we know of we have not changed anything to the configurations on that device.

5. This challenge can always be reproduced. For all Flatpak apps. But only with the same device. We are not able to reproduce this challenge on any other devices.

6. The needed end result is that, on that device, Flatpak sandboxed apps should not have access to any folders and files outside their sandboxes. Per both the Flatpak global and per app configuration.

-– — — — — — — — — — — — — — — —

What we tried that did not resolved this challenge

• Restarted device

• Double-checked permissions for ALL apps (global). Using:

•___ Flatseal

• Double-checked permissions PER app. Using:

__• Command: flatpak info --show-permissions <APP.NAME>__• Flatseal

• Installed new Flatpak app. Which was never installed before. Denied its access to any file or folder. That app also has access to all files and folders.

• This challenge can always be reproduced. For all Flatpak apps. But only with one and same device. We are not able to reproduce this challenge on any other devices. Still on that device, sandboxing was successful. But then, somehow stopped. Beside what we already tried, which his listed down below, what could potentially be causing this challenge?

• Searched tickets at [https://github.com/flatpak/flatpak/issues\] and Found no result.

• Created a ticket with Flatpak engine. A maintainer replied. The maintainer claimed to not understand that ticket. Then, close that ticket without asking any question at https://github.com/flatpak/flatpak/issues/6667 We are assuming good faith from that maintainer. Maybe my ticket was not clear.

-– — — — — — — — — — — — — — — —

ID

Ignore this line. This is a note to myself: ID_E3T4Z2C4

Hi,

whenever I try to open an odt file via the GNOME search in Fedora 44 and in Fedora 44 Silverblue, I get this message. It even happens on a brand new installation of Silverblue in a VM and it seems to me that only the flatpak version is affected.

Any suggestions what causes this and how to get rid of this behaviour would be very appreciated!

Cheers. :)

EDIT: u/SomeGenericUsername posted that this seems to be a known issue: https://gitlab.gnome.org/GNOME/nautilus/-/work_items/4225