Distributors entering Flatpakland [LWN.net]

Distributors entering Flatpakland

Posted Jul 8, 2022 17:28 UTC (Fri) by jafd (subscriber, #129642)
Parent article: Distributors entering Flatpakland

I'm wondering if it's possible to hold flatpaks at least to the same standard as the regular RPMs. The thing is, while your base system may be carefully vetted and secure and stuff, you have at least one other base system when using flatpaks. Or, when you use enough of them, several base systems aka runtimes. To what standards are those runtimes being held? What does prevent me from building broken flatpaks each carrying its own (vulnerable) libssl, libz or other libraries which sort of have to be a part of a runtime but there's no authority telling me they MUST use them? Who is going to audit and vet projects that build themselves in a funny way?

Yeah, I know, I know, it's possible with the current systems, blah blah blah, consider VMWare Workstation hauling its own GTK+ and its dependencies, blah blah. But when it comes to open source, much of the tiring work in packaging goes into ensuring that each and every package builds against system libraries (I know, Java is going to be different soon, but that's beside the point). So if there's another hole in libssl, you update to a patched version, restart processes, and you know every one of them is patched.

But Flatpak advertises very very loudly that they are more secure, and they have a sandbox which no one else has, and it's inevitably going to create a false sense of security. There's going to be a lot of people mindlessly repeating this mantra while the sandbox is really a theater in many cases.

There have been lots of terrible tutorials about server software encouraging downloading random docker images and running them. How sure could you be that an image from some IvanNotALittleBitCreepy would do no more and no less than what it said on the tin? I expect the same kind of problems bloom from the proliferation of flatpaks.

If a vulnerability opens a way for a malicious actor to not infect your "immutable and very secure" base system but go for /var/lib/flatpak, it's going to be just as juicy a target. What measures are there in place to ensure that unpacked flatpaks *stay* what they are? What measures are there to ensure their ongoing integrity?

Also, it would be darn nice to, say, revoke access from microphone and webcams at will without having programs break. I want to be able to deny programs access to my things without telling them I deny it. IMO it's a major oversight on other platforms. Imagine a piece of software which starts mining cryptomoney if you deny it notifications or microphone access.

Mind you, I'm very philosophical about flatpaks. If it has to be a cross-distribution format, so be it. I like RPMs very much, but let flatpaks thrive. Can be AppImages for all I care. But I'd like to have it without misleading advertising, without security theater and some real benefits app isolation can give so I can have power over the application vendors. And I'd like open source packages to be up to traditional expectations as well (so I can still get a tarball and repackage it myself as I see fit, no tivoisation please).

to post comments

Distributors entering Flatpakland

Posted Jul 8, 2022 19:43 UTC (Fri) by re:fi.64 (subscriber, #132628) [Link] (8 responses)

> Also, it would be darn nice to, say, revoke access from microphone and webcams at will without having programs break. I want to be able to deny programs access to my things without telling them I deny it. IMO it's a major oversight on other platforms. Imagine a piece of software which starts mining cryptomoney if you deny it notifications or microphone access.

This *should* be entirely possible in combination with Pipewire + Wireplumber, by creating a script that revokes microphone access when it detects it's a Flatpak, but my experiments haven't been successful yet (mostly because I've never played with WP scripting before and have no idea what I'm doing).

Distributors entering Flatpakland

Posted Jul 9, 2022 8:37 UTC (Sat) by jafd (subscriber, #129642) [Link] (7 responses)

This should be a standard feature. It would provide an immense advantage over literally any other platform out there.

(The next step could be an ability to route any video as webcam or any application/audio file as microphone, but I concede this can be somewhere in advanced options.)

Distributors entering Flatpakland

Posted Jul 9, 2022 11:24 UTC (Sat) by khim (subscriber, #9252) [Link] (5 responses)

> This should be a standard feature.

If that would be a standard feature then app developers can and will find a way to detect that you denied a mic access.

Which would defeat the purpose of that feature.

Distributors entering Flatpakland

Posted Jul 9, 2022 13:15 UTC (Sat) by jafd (subscriber, #129642) [Link] (4 responses)

Y’know, I can make a contraption with my ALSA/Pipewire even now. It’s going to be pretty much indistinguishable. But it’s a lot of time poured into it that doesn’t quite scale.

Applications that try to invoke things like machine learning or escape the sandbox to make sure I’m giving them a real mic should burn in hell anyway, no one ever does it for a good reason.

Distributors entering Flatpakland

Posted Jul 9, 2022 13:52 UTC (Sat) by Wol (subscriber, #4433) [Link] (3 responses)

In GooglePlay land, it should be behaviour that gets you banned. If you don't need a mic, then don't demand it ...

imho, an app demanding mic access when it doesn't need it is pretty much the definition of nefarious ... it would get it deleted from my system instantly.

Cheers,
Wol

Distributors entering Flatpakland

Posted Jul 9, 2022 15:22 UTC (Sat) by jafd (subscriber, #129642) [Link] (2 responses)

Even if it needs the mic for its purported function, once the access is granted, it’s a free-for-all. How sure can I be that it’s only using my mic when I want it to? That it’s not snooping behind my back? How can I be sure that it’s using the mic I want it to use, provided I have more than one (we’re talking about general-purpose computers here, not phones)? Can I revoke the access after having placed the call?

So many questions here, really.

You may argue, „but with regular .deb or .rpm, an unrestricted app may use anything and everything and not have to ask you!”

Yes. I am aware of this. But this is beside the point.

I’m using software that overwhelmingly doesn’t do any of these things. I have sources I can trust from which I obtain the software. I’m not the one who started the conversation about how the world is full of crooks who invade my privacy with keyloggers, screenshots, webcam access, microphone access, and who knows what else, and how our lord and saviour App Store^W^WFlatpak is going to save us from all of this suffering because they have sandboxing and permissions.

Sigh. They bring up the topic, the onus is on them to show how real good they are.

And if the single point of flatpak (and the one which it sort of delivers) is to remove a layer of package maintainers and let software publishers rule the game, just be upfront about it. No need to go into the domain of fairy tales about how my hair is going to grow silky smooth once I accept flatpak on my systems.

Distributors entering Flatpakland

Posted Jul 9, 2022 21:05 UTC (Sat) by roc (subscriber, #30627) [Link] (1 responses)

In latest Android, when an application is using the microphone there is a visual indication in the status area (a green dot).

When you check the device privacy settings there is a section listing the applications that have used the microphone in the last 24 hours. There is also a master switch there to stop all applications from using the microphone, temporarily.

Android also automatically revokes permissions from apps you haven't used for more than a month.

It's a pretty robust setup, all things considered.

Distributors entering Flatpakland

Posted Jul 10, 2022 17:57 UTC (Sun) by smurf (subscriber, #17840) [Link]

> It's a pretty robust setup, all things considered.

Well, it has become a pretty robust system over the last fifteen years. At first, not so much.

It'd be nice if the Flatpak-and-whatnot people would learn from, and possibly improve upon, the solution(s) Android came up with.

Distributors entering Flatpakland

Posted Jul 11, 2022 20:51 UTC (Mon) by bartoc (guest, #124262) [Link]

The fact is most platforms have pretty simplistic mic and (esp) webcam handling. I'm not sure about OSX but Windows doesn't multiplex access to webcams at all, so only one app can use the webcam at a time!

I think both of these things are goals of pipewire, hopefully someone will develop simple tools to do this (every such tool I have used on other platforms has a UI modeled after like, manual switching panels that I find difficult to use).