mirror of
https://github.com/flatpak/flatpak.git
synced 2026-09-23 05:35:46 -04:00
Sebastian Wick
ad044fc728
Extension content is controlled by the extension developer. When setting up the sandbox, Flatpak accesses the .ref file and iterates merge_dirs within the extension's files directory on the host using path-based operations that follow symlinks. A malicious extension can place symlinks that escape the extension directory, causing Flatpak's host process to access arbitrary host paths. This discloses host directory listings to the sandboxed application via the resulting merge symlinks. Use glnx_chaseat with GLNX_CHASE_RESOLVE_BENEATH to confine path resolution to the extension's files directory. Resolves: https://github.com/flatpak/flatpak/security/advisories/GHSA-w69g-9x8j-7p8f
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
See https://flatpak.org/ for more information.
Flatpak is available in the package repositories of most Linux distributions and can be installed from there. See https://flatpak.org/setup/ for quick setup instructions for many distributions.
Community discussion happens in #flatpak:matrix.org, on the mailing list, and on the Flathub Discourse.
Read documentation for Flatpak here.
Contributing
Flatpak welcomes contributions from anyone! Here are some ways you can help:
- Fix one of the issues and submit a PR
- Update flatpak's translations and submit a PR
- Improve flatpak's documentation, hosted at http://docs.flatpak.org and developed over in flatpak-docs
- Find a bug and submit a detailed report including your OS, flatpak version, and the steps to reproduce
- Add your favorite application to Flathub by writing a flatpak-builder manifest and submitting it
- Improve the Flatpak support in your favorite Linux distribution
Hacking
See CONTRIBUTING.md
Related Projects
Here are some notable projects in the Flatpak ecosystem:
- Flatseal: An app for managing permissions of Flatpak apps without using the CLI
- Flat-manager: A tool for managing Flatpak repositories