I installed Okular as a flatpak, with the expectation that it could easily be limited to a single directory (my main system also has Okular)–to help avoid problems from any malware in my pdfs. It is installed at the system level. I have tried using sudo flatpak override and Flatseal to limit flatpak okular to a single directory. flatpak info seems to show a configuration that should limit it to a single directory. But when I run okular using flatpak run org.kde.okular, okular has the run of my home directory–I can open any directory, any pdf, and write to the pdf.
Here is my configuration, according to flatpak info:
$ sudo flatpak info --show-permissions org.kde.okular
[sudo] password for pm:
[Context]
shared=network;ipc;
sockets=x11;wayland;fallback-x11;
filesystems=xdg-config/kdeglobals:ro;/home/pm/Documents/Personal 2022/Flatpak TO READ;
[Session Bus Policy]
com.canonical.AppMenu.Registrar=talk
org.kde.kconfig.notify=talk
org.kde.KGlobalSettings=talk
org.freedesktop.login1=talk
org.kde.kdeconnect=talk
org.freedesktop.ScreenSaver=talk
[Environment]
FLATPAK_GL_DRIVERS=mesa
Relevant System Information:
Linux pm-cpp 6.8.0-51-generic #52-Ubuntu SMP PREEMPT_DYNAMIC Thu Dec 5 13:09:44 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
Screenshots or Error Messages:
The problem is that okular from flatpak, despite presumably being restricted to a given directory by flatpak permissions, has complete read / write access to my home directory and all subdirectories.
What I’ve Tried:
As mentioned, I’ve used sudo flatpak override and Flatseal to try a multitude of permission restrictions to prevent my flatpak okular from accessing anything but a single directory, but this has failed. I have also tried shutting down network and ipc access, but okular continues to have read / write access to everything in my home directory.
Hi @slowtrain55 - I don’t know a lot about flatpak sandboxing, sorry. Someone else may come along shortly with a suggestion there.
The only alternative I can suggest is to snap install okular and then try snap disconnect okular:home, which would completely remove access to your home directory from that application.
I’m just giving this as an alternative option, and not saying there’s anything wrong with the flatpak. I just don’t know it that well, that’s all.
Thanks popey: That’s a good suggestion! I’m inclined to flatpak because I’ve heard that it has a better security / restriction system in place than snap. And my vscodium is in flatpak. So would still like to hear if anyone can figure out what’s going wrong with my setup? But if not, snap sounds like a decent fallback.
I’ve learned more about how flatpak sandboxing / permissions work. Evidently, flatpak uses ‘portals’ to allow system access. One such portal is the system’s file dialog. When a user opens a file with the file dialog, they are implicitly giving permission to flatpak’s app to open that file. So, while it may seem like the app has the run of the user’s file system, it only opens / writes to files the user has implicitly given permission to do that. Malware in the flatpak app, then, should not be able to access the file system. So, maybe there’s nothing wrong with my setup. Of course, it’s a little tough to confirm that flatpak Okular doesn’t have complete access to my filesystem.
I tried to check if the portal serves as a barrier to access by deleting /usr/share/xdg-desktop-portal/portals/kde.portal and also by placing the following lines in /var/lib/flatpak/overrides/org.kde.okular . In both cases, flatpak Okular continues to have apparently unlimited access to my filesystem. At this point, I’m reduced to taking it on faith that flatpak is set up to block access that is not user authorized.
[Session Bus Policy]
org.freedesktop.portal.Access=talk
org.freedesktop.portal.FileChooser=talk
org.freedesktop.portal.ScreenCast=none
org.freedesktop.portal.Screenshot=none
org.freedesktop.portal.RemoteDesktop=none
Thanks 1fallen! I’ve used Flatseal, and it is handy. My issue is that I seem to be able to open and write to any directory from my flatpak Okular, even though I only set up one directory for access. I’ve read, more recently, that flatpak takes user actions in ‘portals’, which can include the system’s file dialogue, as implicit permission from the user to work with a file. That would explain why nothing I do seems to stop flatpak okular from accessing whatever files or directories I go to with the file dialogue. That would be fine by me–my main concern is possible malware in the pdf’s that might try to access my system. Problem is, I can’t see any way to determine whether flatpak is blocking access to my home directory for okular when I’m not using the system file dialogue. I tried to shut down all portals in flatpak to see if they at least act as a barrier to access, but nothing changes–okular can still open and write to any file on my home directory.
Yes it depends on the application (flatpak) and how much of the system will it need (as your user).
we always know that is a slight but real chance.
If your super cautious you could run a separate system in a VM and use as a safetynet.
I left that kind of vague, And, all of this is only about static permissions. Okular also supports portals.(which you have mentioned) Those do not give the app access to the home directory or anything else. They give you the ability to give the app access to certain files. So if you don’t want Okular to open files in your home directory, don’t open files in your home directory with Okular.
No sure where you read such stuff, but this is definitely not true, they do use different designs and philosophies with snap defaulting to being way more locked down by default (in fact a default snap can not access anything on your system, this is not optional, while flatpack does exactly the opposite (rather open by default, expecting the user to do a lock-down via flatseal))
Snaps come as a compressed gpg signed readonly filesystem image that gets loop mounted (never unpacked) which makes them 100% tinker-proof on disk (and keeps the disk footprint small). If you disconnect all interfaces a snap will not be able to see any system resources (many snaps do auto-connect interfaces after review by the security team working on the snap store though, for user convenience )
One thing that is true though is that snaps switch to a degraded security mode on systems that do not have all the advanced security features enabled in-kernel that an Ubuntu kernel provides, you can check if your snaps are in this mode with the snap debug confinement command (which will either return strict or partial)…
Thanks ogra: I think I came away with the impression that snaps are less secure because I had read that bubblewrap was quite secure and had minimal attack surface, compared to firejail or apparmor. But I now understand that snap comes with tighter restrictions out of the box than flatpak. Wish there were something like Flatseal for snaps though–it still remains tricky to restrict snaps to a single directory. I could restrict it to removable storage and bind a folder there, but that means access to sensitive removable storage and some maintenance. I could alter the apparmor profile for snap okular, but I gather that could be changed by updates. Maybe altering some global apparmor configurations. In any event, I’m not at this point convinced that flatpak’s portals are restricting file access for okular because turning off the portals does nothing. So, snap seems more attractive.
