<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi,</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
just want to follow up on this again. Is using firewall with flatpak a suggested approach to limit the network permission? Or maybe it's too difficult to achieve useful outcome? Just wanna get the 2 cents from the experts before digging further
<span id="🙂">🙂</span><br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<b><br>
</b></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks!</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Winnie<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div>
<div id="appendonsend"></div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> Winnie Poon <winniepoon_home@hotmail.com><br>
<b>Subject:</b> Re: --share=network permission</font>
<div> </div>
</div>
<div dir="ltr">
<div>Thanks Alex. Can i possibly use iptables inside the sandbox to further limit the access? LIke can i install iptables inside the sandbox and go from there? or the firewall approach has to be outside the sandbox?</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> Alexander Larsson <alexl@redhat.com><br>
<b>Sent:</b> September 4, 2019 1:45 AM<br>
<b>To:</b> Winnie Poon <winniepoon_home@hotmail.com><br>
<b>Cc:</b> flatpak <flatpak@lists.freedesktop.org><br>
<b>Subject:</b> Re: --share=network permission</font>
<div> </div>
</div>
<div class="x_BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="x_PlainText">On Tue, Sep 3, 2019 at 9:28 PM Winnie Poon <winniepoon_home@hotmail.com> wrote:<br>
><br>
> Hi,<br>
><br>
> i'm working on running our product in the flatpak sandbox environment, and we had to punch a few holes, one being "--share=network" for it to work.<br>
><br>
> wanna see how others do it. It seems like this network hole is a big hole to punch. By relaxing this permission, would it defeat the purpose of a sandbox environment? Is there a better way than this blanket access?<br>
<br>
I think a majority of apps these days use some form of network access.<br>
Its definately not something that e.g. android or iphone warn you<br>
about when installing an app. So, I think in general this is fine.<br>
<br>
However, it would be nice if we had a way to grant less than "full"<br>
network access. For example a NATed/firewalled mode where incoming<br>
accesses would be disallowed. However, at this point that is<br>
technically hard to do as an unprivileged user with the current kernel<br>
APIs.<br>
<br>
-- <br>
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=<br>
Alexander Larsson Red Hat, Inc<br>
alexl@redhat.com alexander.larsson@gmail.com<br>
</div>
</span></font></div>
</div>
</div>
</div>
</body>
</html>