mirror/flatpak
1
0
Fork 0
mirror of https://github.com/flatpak/flatpak.git synced 2026-03-09 02:33:00 -04:00
Code Issues Packages Projects Releases Wiki Activity

run, override: Clarify the effect of --nofilesystem

Browse Source 
There are two reasonable interpretations for --nofilesystem=home:
either it revokes a previous --filesystem=home (as in Flatpak 1.12.2 and
older versions), or it completely forbids access to the home directory
(as in Flatpak 1.12.3). Clarify the man pages to indicate that it only
revokes a previous --filesystem=home. This will hopefully reduce
mismatches between the design and what users expect to happen, as
in flatpak#4654.

A subsequent commit will introduce a way to get the Flatpak 1.12.3
behaviour in a way that is more backwards-compatible with Flatpak 1.12.2
and older versions.

Signed-off-by: Simon McVittie <smcv@collabora.com>
(cherry picked from commit 7bbeed2b87)
This commit is contained in:
Simon McVittie
2022-01-16 12:38:25 +00:00
committed by Simon McVittie
parent a4291cd8e0
commit 4a93202fc8
2 changed files with 44 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
doc/flatpak-override.xml
View File

@@ -223,13 +223,31 @@
<term><option>--nofilesystem=FILESYSTEM</option></term>
<listitem><para>
Remove access to the specified subset of the filesystem from
the application. This overrides to the Context section from the
Undo the effect of a previous
<option>--filesystem=</option><arg choice="plain">FILESYSTEM</arg>
in the app's manifest or a lower-precedence layer of
overrides, and/or remove a previous
<option>--filesystem=</option><arg choice="plain">FILESYSTEM</arg>
from this layer of overrides.
This overrides the Context section of the
application metadata.
<arg choice="plain">FILESYSTEM</arg> can be one of: home, host, host-os, host-etc, xdg-desktop, xdg-documents, xdg-download,
xdg-music, xdg-pictures, xdg-public-share, xdg-templates, xdg-videos,
an absolute path, or a homedir-relative path like ~/dir.
<arg choice="plain">FILESYSTEM</arg> can take the same
values as for <option>--filesystem</option>, but the
<arg choice="plain">:ro</arg> and
<arg choice="plain">:create</arg> suffixes are not
used here.
This option can be used multiple times.
</para><para>
This option does not prevent access to a more
narrowly-scoped <option>--filesystem</option>.
For example, if an application has the equivalent of
<option>--filesystem=xdg-config/MyApp</option> in
its manifest or as a system-wide override, and
<literal>flatpak override --user --nofilesystem=home</literal>
as a per-user override, then it will be prevented from
accessing most of the home directory, but it will still
be allowed to access
<filename>$XDG_CONFIG_HOME/MyApp</filename>.
</para></listitem>
</varlistentry>

26
doc/flatpak-run.xml
View File

@@ -366,13 +366,29 @@
<term><option>--nofilesystem=FILESYSTEM</option></term>
<listitem><para>
Remove access to the specified subset of the filesystem from
the application. This overrides to the Context section from the
Undo the effect of a previous
<option>--filesystem=</option><arg choice="plain">FILESYSTEM</arg>
in the app's manifest and/or the overrides set up with
<citerefentry><refentrytitle>flatpak-override</refentrytitle><manvolnum>1</manvolnum></citerefentry>.
This overrides the Context section of the
application metadata.
<arg choice="plain">FILESYSTEM</arg> can be one of: home, host, host-os, host-etc, xdg-desktop, xdg-documents, xdg-download,
xdg-music, xdg-pictures, xdg-public-share, xdg-templates, xdg-videos,
an absolute path, or a homedir-relative path like ~/dir.
<arg choice="plain">FILESYSTEM</arg> can take the same
values as for <option>--filesystem</option>, but the
<arg choice="plain">:ro</arg> and
<arg choice="plain">:create</arg> suffixes are not
used here.
This option can be used multiple times.
</para><para>
This option does not prevent access to a more
narrowly-scoped <option>--filesystem</option>.
For example, if an application has the equivalent of
<option>--filesystem=xdg-config/MyApp</option> in
its manifest or as a system-wide override, and
<literal>flatpak override --user --nofilesystem=home</literal>
as a per-user override, then it will be prevented from
accessing most of the home directory, but it will still
be allowed to access
<filename>$XDG_CONFIG_HOME/MyApp</filename>.
</para></listitem>
</varlistentry>