Cannot share a single file to app if it is recreated after app startup

1

Over at the KeepassXC password manager we had an issue for a longer time, where the Firefox addon used to access our passwords was only operational if the Firefox/Librewolf flatpak app was started after KeepassXC.

Recently we figured out the reason it worked this way. We wanted to make filesystem access so tight that we only passed in the Unix socket file with the filesystem override configuration:

flatpak override --filesystem=xdg-run/app/org.keepassxc.KeePassXC/org.keepassxc.KeePassXC.BrowserServer org.mozilla.firefox

But it turns out that this socket file gets recreated when Keepass starts up, even if it exists already. After that happens, software in the flatpak environment cant connect to the socket anymore.
It is like if flatpak would have done a bind-mount of this file for the app, and the app would still see the original copy of the socket file, while actually that has been replaced on the host system.

My question is, what can we do to give access to this file for the flatpak app, but only this one, while making it so that it is reflected in the app’s view when it is recreated?

Currently we solve it by passing in the file by its parent directory that is not normally recreated, like this:

flatpak override --filesystem=xdg-run/app/org.keepassxc.KeePassXC/:create org.mozilla.firefox

But we treat this as a workaround for giving the app unnecessarily broad access.

If this is not the right place for asking this, please let me know.

3 Likes
2

There was a post on this forum that is somewhat similar to this issue, but it did not receive a response.

3

Ah note flatpak is not Flathub, so I’m indeed not sure this is the correct community forum.

Anyway, I’ve found an issue on flatpak which may be related here:

This explains the cause and could be it, is not it?

4

oh well, I could have paid a little more attention…

but that github issues seems to be it!