flatpak: Tighten sandbox

[MateusRodCosta]

• Remove network permission
• Add ipc permission
• Replace broad devices permission with only dri and input permissions
• Make filesystem permissions read-only (:ro)

[MateusRodCosta]

A few notes:

• Removed network permission since I believe it's not used (if it's used it can be re-added)
• --share=ipc permission is usually needed for X11 and Wayland graphical apps
• There's no need for full --devices=all permission when dri (GPU) and input (gaming controllers) should be enough; though it seems --device=input requires specific flatpak versions (apparently at least 1.15.6)
• File system access should ideally go through portals, but if that's not possible let's leave it as just read-only (afaik it's only needed to provide the required game files)

[blueskythlikesclouds]

Network permission is required for update checker. File system writing is required for writing save and config files to user folder.

What exactly is the benefit of this tightening?

[MateusRodCosta]

Network permission is required for update checker.

Good point. I forgot about this update checker.

File system writing is required for writing save and config files to user folder.
If it's written in any place inside the ~/.var/app/<app_id> folder then there's not need of giving it permissions, the app already has access to its own folder.
If it's written outside that folder then it can be potentially restricted to just rw access to the one folder the game uses.

IMHO, if access to /run, /run/media and /mnt is mostly used to make it easy to do the initial setup from files on removable/external media, then it makes sense to have it ro unless the app does some kind of extracting on those devices and thus require rw access.
But, if the actual need for --filesystem=host is for rw access to ~/.config/UnleashedRecomp, that likely can be solved with --filesystem=xdg-config/UnleashedRecomp:create

What exactly is the benefit of this tightening?

Mostly Principle of Least Privilege.
While Network access would have to be re-added for the update checker, the --device and --filesystem changes try to reduce to the minimum need for the game to operate.

[MateusRodCosta]

• Remove network permission
• Add ipc permission
• Replace broad devices permission with only dri and input permissions
• Make filesystem permissions read-only (:ro)

[MateusRodCosta]

A few notes:

• Removed network permission since I believe it's not used (if it's used it can be re-added)
• --share=ipc permission is usually needed for X11 and Wayland graphical apps
• There's no need for full --devices=all permission when dri (GPU) and input (gaming controllers) should be enough; though it seems --device=input requires specific flatpak versions (apparently at least 1.15.6)
• File system access should ideally go through portals, but if that's not possible let's leave it as just read-only (afaik it's only needed to provide the required game files)

[blueskythlikesclouds]

Network permission is required for update checker. File system writing is required for writing save and config files to user folder.

What exactly is the benefit of this tightening?

[MateusRodCosta]

Network permission is required for update checker.

Good point. I forgot about this update checker.

File system writing is required for writing save and config files to user folder.
If it's written in any place inside the ~/.var/app/<app_id> folder then there's not need of giving it permissions, the app already has access to its own folder.
If it's written outside that folder then it can be potentially restricted to just rw access to the one folder the game uses.

IMHO, if access to /run, /run/media and /mnt is mostly used to make it easy to do the initial setup from files on removable/external media, then it makes sense to have it ro unless the app does some kind of extracting on those devices and thus require rw access.
But, if the actual need for --filesystem=host is for rw access to ~/.config/UnleashedRecomp, that likely can be solved with --filesystem=xdg-config/UnleashedRecomp:create

What exactly is the benefit of this tightening?

Mostly Principle of Least Privilege.
While Network access would have to be re-added for the update checker, the --device and --filesystem changes try to reduce to the minimum need for the game to operate.

[MateusRodCosta]

• Remove network permission
• Add ipc permission
• Replace broad devices permission with only dri and input permissions
• Make filesystem permissions read-only (:ro)

[MateusRodCosta]

A few notes:

• Removed network permission since I believe it's not used (if it's used it can be re-added)
• --share=ipc permission is usually needed for X11 and Wayland graphical apps
• There's no need for full --devices=all permission when dri (GPU) and input (gaming controllers) should be enough; though it seems --device=input requires specific flatpak versions (apparently at least 1.15.6)
• File system access should ideally go through portals, but if that's not possible let's leave it as just read-only (afaik it's only needed to provide the required game files)

[blueskythlikesclouds]

Network permission is required for update checker. File system writing is required for writing save and config files to user folder.

What exactly is the benefit of this tightening?

[MateusRodCosta]

Network permission is required for update checker.

Good point. I forgot about this update checker.

File system writing is required for writing save and config files to user folder.
If it's written in any place inside the ~/.var/app/<app_id> folder then there's not need of giving it permissions, the app already has access to its own folder.
If it's written outside that folder then it can be potentially restricted to just rw access to the one folder the game uses.

IMHO, if access to /run, /run/media and /mnt is mostly used to make it easy to do the initial setup from files on removable/external media, then it makes sense to have it ro unless the app does some kind of extracting on those devices and thus require rw access.
But, if the actual need for --filesystem=host is for rw access to ~/.config/UnleashedRecomp, that likely can be solved with --filesystem=xdg-config/UnleashedRecomp:create

What exactly is the benefit of this tightening?

Mostly Principle of Least Privilege.
While Network access would have to be re-added for the update checker, the --device and --filesystem changes try to reduce to the minimum need for the game to operate.

[MateusRodCosta]

• Remove network permission
• Add ipc permission
• Replace broad devices permission with only dri and input permissions
• Make filesystem permissions read-only (:ro)

[MateusRodCosta]

A few notes:

• Removed network permission since I believe it's not used (if it's used it can be re-added)
• --share=ipc permission is usually needed for X11 and Wayland graphical apps
• There's no need for full --devices=all permission when dri (GPU) and input (gaming controllers) should be enough; though it seems --device=input requires specific flatpak versions (apparently at least 1.15.6)
• File system access should ideally go through portals, but if that's not possible let's leave it as just read-only (afaik it's only needed to provide the required game files)

[blueskythlikesclouds]

Network permission is required for update checker. File system writing is required for writing save and config files to user folder.

What exactly is the benefit of this tightening?

[MateusRodCosta]

Network permission is required for update checker.

Good point. I forgot about this update checker.

File system writing is required for writing save and config files to user folder.
If it's written in any place inside the ~/.var/app/<app_id> folder then there's not need of giving it permissions, the app already has access to its own folder.
If it's written outside that folder then it can be potentially restricted to just rw access to the one folder the game uses.

IMHO, if access to /run, /run/media and /mnt is mostly used to make it easy to do the initial setup from files on removable/external media, then it makes sense to have it ro unless the app does some kind of extracting on those devices and thus require rw access.
But, if the actual need for --filesystem=host is for rw access to ~/.config/UnleashedRecomp, that likely can be solved with --filesystem=xdg-config/UnleashedRecomp:create

What exactly is the benefit of this tightening?

Mostly Principle of Least Privilege.
While Network access would have to be re-added for the update checker, the --device and --filesystem changes try to reduce to the minimum need for the game to operate.

[MateusRodCosta]

• Remove network permission
• Add ipc permission
• Replace broad devices permission with only dri and input permissions
• Make filesystem permissions read-only (:ro)

[MateusRodCosta]

A few notes:

• Removed network permission since I believe it's not used (if it's used it can be re-added)
• --share=ipc permission is usually needed for X11 and Wayland graphical apps
• There's no need for full --devices=all permission when dri (GPU) and input (gaming controllers) should be enough; though it seems --device=input requires specific flatpak versions (apparently at least 1.15.6)
• File system access should ideally go through portals, but if that's not possible let's leave it as just read-only (afaik it's only needed to provide the required game files)

[blueskythlikesclouds]

Network permission is required for update checker. File system writing is required for writing save and config files to user folder.

What exactly is the benefit of this tightening?

[MateusRodCosta]

Network permission is required for update checker.

Good point. I forgot about this update checker.

File system writing is required for writing save and config files to user folder.
If it's written in any place inside the ~/.var/app/<app_id> folder then there's not need of giving it permissions, the app already has access to its own folder.
If it's written outside that folder then it can be potentially restricted to just rw access to the one folder the game uses.

IMHO, if access to /run, /run/media and /mnt is mostly used to make it easy to do the initial setup from files on removable/external media, then it makes sense to have it ro unless the app does some kind of extracting on those devices and thus require rw access.
But, if the actual need for --filesystem=host is for rw access to ~/.config/UnleashedRecomp, that likely can be solved with --filesystem=xdg-config/UnleashedRecomp:create

What exactly is the benefit of this tightening?

Mostly Principle of Least Privilege.
While Network access would have to be re-added for the update checker, the --device and --filesystem changes try to reduce to the minimum need for the game to operate.

[MateusRodCosta]

• Remove network permission
• Add ipc permission
• Replace broad devices permission with only dri and input permissions
• Make filesystem permissions read-only (:ro)

[MateusRodCosta]

A few notes:

• Removed network permission since I believe it's not used (if it's used it can be re-added)
• --share=ipc permission is usually needed for X11 and Wayland graphical apps
• There's no need for full --devices=all permission when dri (GPU) and input (gaming controllers) should be enough; though it seems --device=input requires specific flatpak versions (apparently at least 1.15.6)
• File system access should ideally go through portals, but if that's not possible let's leave it as just read-only (afaik it's only needed to provide the required game files)

[blueskythlikesclouds]

Network permission is required for update checker. File system writing is required for writing save and config files to user folder.

What exactly is the benefit of this tightening?

[MateusRodCosta]

Network permission is required for update checker.

Good point. I forgot about this update checker.

File system writing is required for writing save and config files to user folder.
If it's written in any place inside the ~/.var/app/<app_id> folder then there's not need of giving it permissions, the app already has access to its own folder.
If it's written outside that folder then it can be potentially restricted to just rw access to the one folder the game uses.

IMHO, if access to /run, /run/media and /mnt is mostly used to make it easy to do the initial setup from files on removable/external media, then it makes sense to have it ro unless the app does some kind of extracting on those devices and thus require rw access.
But, if the actual need for --filesystem=host is for rw access to ~/.config/UnleashedRecomp, that likely can be solved with --filesystem=xdg-config/UnleashedRecomp:create

What exactly is the benefit of this tightening?

Mostly Principle of Least Privilege.
While Network access would have to be re-added for the update checker, the --device and --filesystem changes try to reduce to the minimum need for the game to operate.

[MateusRodCosta]

• Remove network permission
• Add ipc permission
• Replace broad devices permission with only dri and input permissions
• Make filesystem permissions read-only (:ro)

[MateusRodCosta]

A few notes:

• Removed network permission since I believe it's not used (if it's used it can be re-added)
• --share=ipc permission is usually needed for X11 and Wayland graphical apps
• There's no need for full --devices=all permission when dri (GPU) and input (gaming controllers) should be enough; though it seems --device=input requires specific flatpak versions (apparently at least 1.15.6)
• File system access should ideally go through portals, but if that's not possible let's leave it as just read-only (afaik it's only needed to provide the required game files)

[blueskythlikesclouds]

Network permission is required for update checker. File system writing is required for writing save and config files to user folder.

What exactly is the benefit of this tightening?

[MateusRodCosta]

Network permission is required for update checker.

Good point. I forgot about this update checker.

File system writing is required for writing save and config files to user folder.
If it's written in any place inside the ~/.var/app/<app_id> folder then there's not need of giving it permissions, the app already has access to its own folder.
If it's written outside that folder then it can be potentially restricted to just rw access to the one folder the game uses.

IMHO, if access to /run, /run/media and /mnt is mostly used to make it easy to do the initial setup from files on removable/external media, then it makes sense to have it ro unless the app does some kind of extracting on those devices and thus require rw access.
But, if the actual need for --filesystem=host is for rw access to ~/.config/UnleashedRecomp, that likely can be solved with --filesystem=xdg-config/UnleashedRecomp:create

What exactly is the benefit of this tightening?

Mostly Principle of Least Privilege.
While Network access would have to be re-added for the update checker, the --device and --filesystem changes try to reduce to the minimum need for the game to operate.

[MateusRodCosta]

• Remove network permission
• Add ipc permission
• Replace broad devices permission with only dri and input permissions
• Make filesystem permissions read-only (:ro)

[MateusRodCosta]

A few notes:

• Removed network permission since I believe it's not used (if it's used it can be re-added)
• --share=ipc permission is usually needed for X11 and Wayland graphical apps
• There's no need for full --devices=all permission when dri (GPU) and input (gaming controllers) should be enough; though it seems --device=input requires specific flatpak versions (apparently at least 1.15.6)
• File system access should ideally go through portals, but if that's not possible let's leave it as just read-only (afaik it's only needed to provide the required game files)

[blueskythlikesclouds]

Network permission is required for update checker. File system writing is required for writing save and config files to user folder.

What exactly is the benefit of this tightening?

[MateusRodCosta]

Network permission is required for update checker.

Good point. I forgot about this update checker.

File system writing is required for writing save and config files to user folder.
If it's written in any place inside the ~/.var/app/<app_id> folder then there's not need of giving it permissions, the app already has access to its own folder.
If it's written outside that folder then it can be potentially restricted to just rw access to the one folder the game uses.

IMHO, if access to /run, /run/media and /mnt is mostly used to make it easy to do the initial setup from files on removable/external media, then it makes sense to have it ro unless the app does some kind of extracting on those devices and thus require rw access.
But, if the actual need for --filesystem=host is for rw access to ~/.config/UnleashedRecomp, that likely can be solved with --filesystem=xdg-config/UnleashedRecomp:create

What exactly is the benefit of this tightening?

Mostly Principle of Least Privilege.
While Network access would have to be re-added for the update checker, the --device and --filesystem changes try to reduce to the minimum need for the game to operate.