The Permissions Conundrum

1

Hi, I’m new here and hopefully placed this thread in the correct category, if not I’d like to ask a mod to move it where it’s appropriate.

I’m new to Linux and still struggle with directory structure and most of the terminal, but I’m learning. Anyway,

I’m using Fedora and it has mostly been a blast to use with very minor tinkering to get it to, what I’m otherwise accustomed to, doing on Windows. But as far as installing software I encountered an issue many people seem to agree on - the permissions issue. I understand why sandboxing for security and being a container for the software and adherent dependencies are efficient in skipping the middleman.

The problem is whenever the said software inside that container needs access to write on a drive, access to a device, accessories and everything else in between - requires me to google up a command I don’t know if I can fully trust, paste it into the terminal I’m not comfortable using, just to give the software whatever the necessities it requires. Using Flatseal didn’t always help, maybe 30% of the time and I pressed on every permission listed I could give just to minimize the hassle. It’s time and energy I could spend on other things instead of trying to make things work that already should be out of the box.

So my suggestion is, why not just make the Flatpak system ask the user with a simple popup if you want to give access to insert specifics? Both iOS and Android do this effortless thing, there’s no reason Flatpak can’t do the same.

Take my recent tussle with Flatpak, I installed Blender and it couldn’t access my GPU for more efficient rendering and spent an additional 30 minutes troubleshooting until I had to Google for the solution. It’s inconvenient, and no one likes that.

Aside from that Fedora is running pretty well without the need to use the terminal.

1 Like
2

That’s what flatpak is basically doing, just differently. When apps implement that, it will open a file chooser, where you can find your files.

The problem is with (old) apps that haven’t yet adopted these approaches. There is the stop gap of permissions, allowing those apps to still work in most cases. But if you want to do stuff outside of the sandbox or permissible folders, those old applications break.

3

To add a bit more detail, Flatpak’s version of this idea is known as ‘portals’. The idea is that when the app wants to do something, e.g. screensharing, it asks the portal system, the system asks the user what to share, and when the user selects something, the app gets access to it.

Some things, like opening & saving files, can use portals automatically if the app is calling standard APIs in a toolkit like Qt or GTK. But mostly, apps need to be adapted to call portals instead of accessing the same things directly.

On Android & iOS, and even JS in browsers, developers have to work with the sandbox to do these things. But on Linux it’s still a relatively new idea, and lots of code has been written assuming it will run without a sandbox.