Open
Conversation
secureblue-bot
force-pushed
the
f42-secureblue
branch
from
a79c23f to
09778e1
Compare
secureblue-bot
force-pushed
the
f42-secureblue
branch
from
09778e1 to
37e7bbf
Compare
HastD
force-pushed
the
flatpak
branch
2 times, most recently
from
3791472 to
92fe350
Compare
secureblue-bot
force-pushed
the
f42-secureblue
branch
from
e46d04b to
6a429ff
Compare
secureblue-bot
force-pushed
the
f42-secureblue
branch
2 times, most recently
from
64199ab to
81dae83
Compare
secureblue-bot
force-pushed
the
f42-secureblue
branch
2 times, most recently
from
5e06ed5 to
07d2f2e
Compare
secureblue-bot
force-pushed
the
f42-secureblue
branch
from
316918e to
1f16bed
Compare
Currently flatpak is not compatible with SELinux confined users: the flatpak executable does not have the necessary permissions to create the sandbox. This policy solves this by confining the flatpak program itself (and the helper programs it calls, such as bwrap) in an application domain with the necessary permissions, which transitions back into the user domain to run the sandboxed flatpak application. For example, if a `staff_u` user runs a flatpak application from the user domain `staff_t`, flatpak will run in `staff_flatpak_t`, while the app will run in `staff_t`. The policy also includes more fine-grained labeling for flatpak app library files, data files, cache files, and temporary files. Signed-off-by: Daniel Hast <hast.daniel@protonmail.com>
Fixes denials that newly show up with this policy in Fedora 43.
Fixes an AVC denial.
Also correctly mark them as templates rather than interfaces.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Currently flatpak is not compatible with SELinux confined users: the flatpak executable does not have the necessary permissions to create the sandbox. This policy solves this by confining the flatpak program itself (and the helper programs it calls, such as bwrap) in an application domain with the necessary permissions, which transitions back into the user domain to run the sandboxed flatpak application.
For example, if a
staff_uuser runs a flatpak application from the user domainstaff_t, flatpak will run instaff_flatpak_t, while the app will run instaff_t.The policy also includes more fine-grained labeling for flatpak app library files, data files, cache files, and temporary files.
A couple logistical notes:
flatpak-system-helper, and we don't want to accidentally override that policy.