Distributors entering Flatpakland [LWN.net]

Distributors entering Flatpakland

Posted Jul 10, 2022 8:06 UTC (Sun) by jengelh (subscriber, #33263)
In reply to: Distributors entering Flatpakland by walters
Parent article: Distributors entering Flatpakland

There was a proposal to use more filetriggers. This would put very common calls like ldconfig, manpage caches and things like that back in the hands of the glibc, man, etc. RPMs, and, as a result, the only %post scripts that should remain are the messy or the nasty ones for which you can then put up big warnings/reject during build/installation/etc.

to post comments

Distributors entering Flatpakland

Posted Jul 11, 2022 18:40 UTC (Mon) by walters (subscriber, #7396) [Link]

Sure, though that doesn't help at all with the "can put a systemd unit in /etc/systemd/system with an ExecStart=/usr/bin/myapp --inject-root-shell" problem.

flatpak is scoped to install only GUI/desktop applications that should run without any host privileges; you can't use today flatpak to install a (system wide) VPN system or whatever. So by limiting its scope, it is much more secure for its target domain.