3 ms·
Aren't flatpaks sandboxed? Does that help mitigate the risk somewhat?
by Yuioup 7y ago
Aren't flatpaks sandboxed? Does that help mitigate the risk somewhat?
- danieldk 7y agoTheoretically yes (minus you are only one kernel vulnerability away from elevated access). However, a lot of Flatpaks take blanket access to the home directory or host filesystem: https://github.com/search?q=org%3Aflathub+%22--filesystem%3Dhome%22&type=Code https://github.com/search?q=org%3Aflathub+%22--filesystem%3D... https://github.com/search?q=org%3Aflathub+%22--filesystem%3Dhost%22&type=Code https://github.com/search?q=org%3Aflathub+%22--filesystem%3D... So, many applications use it as a distribution mechanism and not so much for sandboxing. Of course, this is bound to get better over time when applications are modified to support sandboxing better and can use portals. IMO you need both: isolation through e.g. sandboxing and timely security updates of applications and all their dependencies. Flatpak currently provides the former for some applications and the latter is completely dependent on the maintainer of the Flatpak.