Flatpak isn’t as strong as a sandbox as Android. But if you tweak permissions, it can be deemed good enough.
If you really wanted security, you’d want to learn SELinux, but that’s a whole rabbit hole of complexity.
this post was submitted on 29 Apr 2025
19 points (100.0% liked)
Linux Questions
1676 readers
2 users here now
Linux questions Rules (in addition of the Lemmy.zip rules)
- stay on topic
- be nice (no name calling)
- do not post long blocks of text such as logs
- do not delete your posts
- only post questions (no information posts)
Tips for giving and receiving help
- be as clear and specific
- say thank you if a solution works
- verify your solutions before posting them as facts.
Any rule violations will result in disciplinary actions
founded 2 years ago
MODERATORS
To elaborate on this a little, you can use Flatseal to specify which directories a Flatpak app can have access to directly. For example, in a music player that stores the path of your music library, you'd want to use Flatseal to be sure it has direct access to that folder. This is similar to GrapheneOS's storage scopes.
Aside from that, apps can also call on a file picker that lets you choose any file/folder on your system, and flatpak then creates a virtual path to bridge to that file/folder without exposing the entire rest of the filesystem. This is nice for one-time open/save commands, but doesn't work for apps that need persistent access to a specific directory like in the music player example. This is similar to Android's file provider API.
I don't recall off the top of my head what flatpak apps have access to by default. Some subset of the home folder, I think?
By default, flatpaks have no permissions. All permissions must be manually specified in the manifest file. But if you look at the top apps on Flathub, they tend to have broad filesystem permissions, including home and host. This are pretty bad permissions because it's insanely easy to escape the sandbox with them since there are no protections against writing to files like .bashrc. Snap at least prevents apps from accessing hidden files for this reason.
You might have some luck with Bubblejail or Firejail. Alternatively, you might want to give one of the Universal Blue images a try. They're Fedora based but immutable. Almost all installations are purposely done in a container using flatpak or distrobox.
Maybe checking out Secureblue would be something to consider?
Interesting project. Might be a good start
Have you looked into podman and Distrobox (which is a wrapper for podman), or toolbox? You can install non-flatpak apps in them, and if you want to get into the weeds, you can declare what each container's permissions are.
"#### Security implications
Isolation and sandboxing are not the main aims of the project, on the contrary it aims to tightly integrate the container with the host. The container will have complete access to your home, pen drive, and so on, so do not expect it to be highly sandboxed like a plain docker/podman container or a Flatpak."
https://distrobox.it/#security-implications
Does not seem to be an ideal fit, but still interesting
Yep, just depends what your particular goals are. They wouldn't have rootful access, but if you need more granular control, podman or docker are likely better suited.
You can use AppArmor to semi-automatically generate security profiles for each app. Once the profiles are in place, it will enforce Mandatory Access Control, securing each app that has a profile.
Here's a guide, it's designed for Ubuntu but will work with any distro.
Nice, this seems cool, read a bit about it. I will definitely check it out.
What's the end goal?
Similar security as Android. Being able to install apps without checking too closely if it is safe or not
That's bad on Android as well
There is no way of making that work