Edit permissions of Flatpak applications in TUXEDO OS - TUXEDO Computers

With KDE Plasma 5.27, its control panel received a module for assigning and editing rights for Flatpaks. This betters the already good integration of Flatpaks in KDE Plasma's software shop Discover and is thus also available to you as a user of TUXEDO OS

Why do Flatpaks need special rights?

Flatpaks are containerized applications that cannot interact with the rest of the system without additional permissions. Without permissions, Flatpaks cannot print, play sound, create files or otherwise access the file system. An example is the KDE music player Elisa, which by default can only add collections that are in the user's home.

The creator of the container decides which rights a Flatpak comes with out of the box. This can be the developer of the application, but also anyone who can create a Flatpak. There are Flatpaks shipped, that have hardly any rights, as well as those that are allowed more than is good and necessary. This often goes beyond the specifications of the Flatpak developers, which stipulate that Flatpaks in the delivery state have no access to system processes or the network and much more. The recommended rights are limited to the user's home and access to the app itself and its runtime environment.

How can Flatpak permissions be viewed and edited?

The permissions of a Flatpak can be displayed on the command line:

flatpak info --show-permissions

flatpak list

sudo flatpak override [package name] --filesystem=/media/john/music/

Edit permissions graphically

Those who prefer graphical editing could previously use the external application Flatseal, which requires about 200 MByte of space when installed as a Flatpack. For KDE users, there is now a new module for the system settings of the Plasma desktop. It can be found in the Applications tab under Flatpak Permission Settings.

The basic settings include access to the Internet, the sound server, the printer, other connected devices and Bluetooth. If necessary, place one or more ticks here.

Portals

The file system access in the second point is mainly controlled via so-called portals. These are a generic mechanism through which applications within a sandbox can interact with the host environment. They allow interacting with data, files and services without the need for additional sandbox permissions. This then interactively queries the root password if needed. Examples of functions that can be accessed via portals are opening files via a file selection dialogue, taking screenshots or printing.

Toolkits such as GTK 3 and 4 or Qt 5 and 6 offer transparent support for portals via the respective desktops, so that access to resources outside the sandbox works securely and immediately. With this approach, applications can avoid having to configure access to large amounts of data or services in a blanket manner, and users have control over what their applications have access to. In this section, you can set new permissions via Add New.

You must first expand the extended permissions via the arrow on the right. There you will find permissions for subsystems such as DBus, sockets such as X11, Wayland and XWayland and devices such as virtual machines and the graphic rendering engine. In general, there is only a need for action when a Flatpak reaches its limits somewhere. You should only assign permissions in advance if you know exactly what you are doing. Currently, KDE still lacks the corresponding documentation.