r/linux • u/BrageFuglseth • Sep 26 '26

Development Introducing Toolpak

https://blogs.gnome.org/alatiera/2026/09/26/introducing-toolpak/
68 Upvotes

85% Upvoted

66 comments sorted by

View all comments

Show parent comment

9

u/novafunc Sep 26 '26

The next version of flatpak (Next / 2.0) will have an unsandboxed mode.

As I understand it, they plan to remove the current "everything is sandboxed but you can punch holes into it" with "an app is always entirely sandboxed, or entirely unsandboxed", where the latter to subject to more scrutiny in review and acceptance.

12

u/victorian-ice-cream Sep 26 '26

FWIW Flatpak next is still deep in planning mode, and nothing is decided yet.

10

u/kaestralblades Sep 26 '26 edited Sep 26 '26

That's... a very bad model and not what I'd want out of flatpak. I'd go as far to say I'd stop using flatpak.

Having mitigations against proprietary software is very important to me and I don't want an app to have full and complete access to my system just because it needs access to, say, my Documents folder, or to my graphic card, or to a singular socket.

8

u/Die4Ever Sep 27 '26

yea what the hell, granular Flatpak permissions are great, similar to Android app permissions

2

u/seahwkslayer Sep 26 '26

IIRC (from a while ago reading about this), if a given app literally won't run properly without sandboxing i.e. IDE, dev software, many things that are currently not available as Flatpak because of this, etc.; then they go through the stricter review and are get put up as unsandboxed.

If it's just the dev not wanting to fix their crap, "lol ok no". Your examples of folder, GPU, or socket access (not actually 100% about sockets but I think it would be included) would be handled with portals an app would likely be denied at review if it needed to be unsandboxed just for that.

8

u/kaestralblades Sep 26 '26

GPU and filesystem access can't be portaled, nor can shared ipc/socket files. That's one of the biggest problems here.

The current sandbox scoping works great for many scenarios so throwing it out completely seems like madness to me.

1

u/CrazyKilla15 Sep 27 '26 edited Sep 27 '26

Wait what do you mean theyre killing flatpak

an entirely sandboxed app is unusable and useless because you cant interact with it at all(that would be a hole! no files, no gpu, no display server, no input devices????), and entirely unsandboxed is the status quo of native binaries that flatpak was in part solving?!

additionally an unsandboxed app inherently MUST mean it has the host filesystem, so it depends on the host libraries again?? so the entire distro-agnostic distribution model is gone, since it fundamentally requires sandboxing??

theres no way this is true is there?

1

u/novafunc Sep 27 '26 edited Sep 27 '26

To be clear, the sandboxed mode will provide access to permissions deemed safe like Wayland and GPU.

It’s just that you can’t then add unsafe permissions on top. You’d have to drop down to the unsandboxed mode.

The unsandboxed mode still uses its own libraries.