Hacker News new | ask | show | jobs
by saltedshiv 2532 days ago
Are flatpaks not all sandboxed? I thought the concept of flatpak and snap was that it offered sandboxing in a way what was never implemented to normal repo packages
1 comments

Flatpak uses kernel namespaces (like docker) to run software with a bundled set of libraries. From their FAQ:

> Flatpak mostly deployed as a convenient library bundling technology early on, with the sandboxing or containerization being phased in over time for most applications.

I don't really know if sandboxing is worth it for me. Running everything inside docker cotnaienrs sounds like an absolute nightmare when it comes to troubleshooting. You might think logs and things would be well defined and put in the right place for the OS to pick up, but if things were so well behaved we wouldn't feel the need for sandboxing now would we.

They are also adding per-application isolation of settings:

https://blogs.gnome.org/mclasen/2019/07/12/settings-in-a-san...

Flatpak is one piece of a broader design to secure Linux workstations. It is also intended to work in conjunction with Wayland and the in-development Pipewire. These lock down video and audio respectively, so that shared resources can't be misused by applications.

we wouldn't feel the need for sandboxing now would we.

Applications have vulnerabilities. Sandboxes help as an additional layer of security for trusted applications.

Of course, if applications are trusted and under control, a simpler mechanism like OpenBSD's pledge/unveil may be enough.

I’ve been running many applications as flatpaks for over a year without issue. Troubleshooting is not too bad either imo.
Flatpak should be ok, I think when it's run inside inaccessible containers it won't be. Are the files sandboxed off from the user running in flatpak?
No, these are bind mounted. Most Linux programs have a standard configuration directory. The application files that don't change would probably be sandboxed so that they can be easily upgraded.