Distributors entering Flatpakland [LWN.net]

Distributors entering Flatpakland

Posted Jul 9, 2022 12:00 UTC (Sat) by walters (subscriber, #7396)
In reply to: Distributors entering Flatpakland by flussence
Parent article: Distributors entering Flatpakland

That wouldn't work because it's not just about runtime sandboxing; traditional package systems that install to your root filesystem usually allow any package to put any file anywhere, *and* have the ability to execute arbitrary code as root (%post scripts) at install/upgrade time.

Achieving the goal requires separating the host and application filesytems.

to post comments

Distributors entering Flatpakland

Posted Jul 10, 2022 8:06 UTC (Sun) by jengelh (subscriber, #33263) [Link] (1 responses)

There was a proposal to use more filetriggers. This would put very common calls like ldconfig, manpage caches and things like that back in the hands of the glibc, man, etc. RPMs, and, as a result, the only %post scripts that should remain are the messy or the nasty ones for which you can then put up big warnings/reject during build/installation/etc.

Distributors entering Flatpakland

Posted Jul 11, 2022 18:40 UTC (Mon) by walters (subscriber, #7396) [Link]

Sure, though that doesn't help at all with the "can put a systemd unit in /etc/systemd/system with an ExecStart=/usr/bin/myapp --inject-root-shell" problem.

flatpak is scoped to install only GUI/desktop applications that should run without any host privileges; you can't use today flatpak to install a (system wide) VPN system or whatever. So by limiting its scope, it is much more secure for its target domain.