<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style> </head> <body dir="ltr"> <div>> Can you give a real world example where you worry about the users<br> </div> <div> <div class="BodyFragment"><font size="2"><span style="font-size:11pt"> <div class="PlainText">> ability to weaken the sandbox?<br> <br> <span>From the perspective of a legitimate user of the system the approach <br> </span></div> <div class="PlainText"><span>you mention makes sense: The user can decide to trust a flatpak app <br> </span></div> <div class="PlainText"><span>and, at runtime, give it additional privileges to access to their system <br> </span></div> <div class="PlainText"><span>as in your photos example, or they can choose not limit it to just the <br> </span></div> <div class="PlainText"><span>access that the author requested, or if they really don't trust it she/he <br> </span></div> <div class="PlainText"><span>can remove access/devices all together.</span></div> <div class="PlainText"><span><br> </span></div> <div class="PlainText"><span>However from the perspective of the application (or rather application developer) <br> </span></div> <div class="PlainText"><span>who may not trust the environment in which the app will run this is a problem. <br> </span></div> <div class="PlainText"><span>We want to make sure that if a hacker gains access to a system on <br> </span></div> <div class="PlainText"><span>which our app is installed, that they cannot run our app with elevated <br> </span></div> <div class="PlainText"><span>access/privilege that would give them the opportunity to snoop data or <br> </span></div> <div class="PlainText"><span>intercept messages.</span></div> <div class="PlainText"><span><br> </span></div> <div class="PlainText"><span>To give some more background, we plan to run our flatpak app on a fully <br> </span></div> <div class="PlainText"><span>locked down system (almost an embedded system) on which a legitimate <br> </span></div> <div class="PlainText"><span>end user has no access to the OS at all. We boot directly into our app <br> </span></div> <div class="PlainText"><span>and the only way the end user can interact with the system is through <br> </span></div> <div class="PlainText"><span>our app. We will of course take as many precautions as possible to prevent <br> </span></div> <div class="PlainText"><span>unauthorized access, but if a hacker does break in we want the sandboxed <br> </span></div> <div class="PlainText"><span>flatpak application to provide and extra layer of defense the will prevent <br> </span></div> <div class="PlainText"><span>the legitimate user's data and activity from being exposed. However if the <br> </span></div> <div class="PlainText"><span>hacker can run our app with elevated access this protection is lost.</span></div> <div class="PlainText"><span><br> </span></div> <div class="PlainText"><span>Regards,</span></div> <div class="PlainText"><span>Winnie<br> </span></div> <div class="PlainText"><br> <span></span><span></span></div> <div class="PlainText"><br> </div> </span></font></div> </div> </body> </html>