mirror of
https://github.com/flatpak/flatpak.git
synced 2026-05-18 21:55:22 -04:00
Instead of exporting any files we add a whilelist of directories that get exported: share/applications share/icons share/dbus-1/services share/gnome-shell/search-providers share/mime/packages This avoids potentially installing some kind of file that the host system reads and interprets in a risky way. Applications and dbus services are safe because we rewrite them. Icons are safe as long as the image loaders are, and if they are not we have worse problems. Search providers and mime formats are somewhat problematic, and follow-up commits will rewrite these to be safer.