Better Flatseal

A fork of Flatseal that adds enable/disable switches to every user-editable permission entry.

What's New

The original Flatseal lets you view and modify Flatpak application permissions. However, once you add an environment variable, filesystem path, persistent path, or D-Bus name, the only way to temporarily "disable" it is to delete the entry and re-add it later.

Better Flatseal adds a GtkSwitch next to every entry in:

• Environment Variables (e.g. http_proxy=http://127.0.0.1:7897)
• Filesystem → Other Files (e.g. ~/Documents:ro)
• Persistent paths (e.g. .config/floorp)
• D-Bus → Session Bus and System Bus names

How It Works

Toggle the switch OFF → the entry is greyed out and excluded from the Flatpak override file. The application no longer sees that permission, but the entry stays visible in Flatseal with its original value preserved.

Toggle the switch ON → the entry is immediately written back to the override file and the application picks it up on next launch.

System-added entries (e.g. baseapp defaults) load with the switch ON by default. You can toggle them off too.

Persistence

Disabled entries are stored per-application in GSettings under the disabled-permissions key (type a{ss}). The key format is:

"app_id:permission_type" → "value1;value2;..."

This means:

• Switching to another app and back preserves the disabled state
• Restarting Flatseal preserves the disabled state
• Clicking Reset clears all disabled entries for the current app

Installation

Prerequisites

• flatpak and flatpak-builder installed
• GNOME Platform 50 runtime: flatpak install --user flathub org.gnome.Platform//50
• GNOME SDK 50 (for building): flatpak install --user flathub org.gnome.Sdk//50

Build & Install

git clone https://github.com/helloydh007/Better-Flatseal.git
cd Better-Flatseal
flatpak-builder --user --force-clean build com.github.tchx84.Flatseal.json

If the build fails at the appstream-compose step (a known issue with some SDK versions), run:

flatpak build-finish --command=com.github.tchx84.Flatseal \
  --filesystem=/var/lib/flatpak/app:ro \
  --filesystem=xdg-data/flatpak/app:ro \
  --filesystem=xdg-data/flatpak/overrides:create \
  --share=ipc --socket=fallback-x11 --socket=wayland --device=dri \
  --talk-name=org.gnome.Software \
  --talk-name=org.freedesktop.impl.portal.PermissionStore \
  build

flatpak-builder --user --export-only --repo=repo build com.github.tchx84.Flatseal.json

flatpak --user remote-add --no-gpg-verify flatseal-local repo
flatpak --user install flatseal-local com.github.tchx84.Flatseal

If you previously had the original Flatseal from Flathub installed, uninstall it first:

flatpak uninstall --user com.github.tchx84.Flatseal

Run

flatpak run com.github.tchx84.Flatseal

Or launch from your application menu.

Usage Example: Network Proxy

A common use case (from issue #830):

1. Open Better Flatseal, select your browser (e.g. Floorp)
2. Scroll to Environment Variables, click +
3. Add http_proxy=http://127.0.0.1:7897 and https_proxy=http://127.0.0.1:7897
4. Make sure both switches are ON
5. Restart the browser → proxy is active
6. When you turn off your VPN, toggle both switches OFF
7. Restart the browser → proxy is disabled, no need to delete the entries
8. Next time you need the proxy, toggle ON and restart

Changed Files

File	Change
data/com.github.tchx84.Flatseal.gschema.xml	New GSettings key disabled-permissions (a{ss})
src/models/settings.js	getDisabledPermissions / setDisabledPermissions / clearAllDisabledPermissions
src/models/permissions.js	Emit appId-changed signal on app switch
src/widgets/variableRow.ui	Added GtkSwitch
src/widgets/variableRow.js	enabled property, _toggled handler, switch sync
src/widgets/pathRow.ui	Added GtkSwitch
src/widgets/pathRow.js	enabled property, _toggled handler, switch sync
src/widgets/relativePathRow.ui	Added GtkSwitch
src/widgets/relativePathRow.js	enabled property, _toggled handler, switch sync
src/widgets/busNameRow.ui	Added GtkSwitch
src/widgets/busNameRow.js	enabled property, _toggled handler, switch sync
src/widgets/pathsViewer.js	Filter disabled rows from text serialization; setDisabledItems / clearDisabledItems / getDisabledItems
src/widgets/permissionEntryRow.js	disabledContent setter/getter, disabled-changed signal
src/widgets/window.js	Wire disabled state for all entry-row types; refresh on app switch
src/style.css	Italic/grey styling for disabled entries

Credits

Based on Flatseal by Martin Abente Lahaye.

License

GPL-3.0, same as the original Flatseal.