Linux Desktops and User Land Infrastructure

Flatpak Sandboxing: Restricting D-Bus Access and Host Filesystem Leaks

Par Kinetikatech Operations Team · Mis à jour 2026-08-09

Flatpak's default sandbox is broader than most users assume. A packaged app can still talk to the session D-Bus, read broad paths through portal abstractions, and inherit host environment variables that leak identity. This guide hardens a Flatpak installation by restricting D-Bus names, narrowing filesystem grants, and verifying the resulting policy with flatpak info and a small test harness.

Points clés

Audit current grants before changing anything. flatpak info --show-permissions lists every filesystem, device, and socket grant, and most surprises live in the shared directories and talk-name lists.
Remove broad filesystem access. Replace --filesystem=home and --filesystem=host with explicit read-only paths such as --filesystem=~/Documents:ro and --filesystem=/run/media:ro.
Restrict D-Bus session access. Use --talk-name for specific services instead of --socket=session-bus, and add --no-talk-name=org.freedesktop.secrets when the app does not need the secret store.
Disable the network socket for offline-only tools. --unshare=network removes all outbound connectivity, which is the single strongest control for untrusted utilities.
Pin portal permissions. xdg-desktop-portal mediates file and screenshot access; review the per-app permission store under ~/.local/share/flatpak/db.
Seal environment variables. --unset-env and --env keep host identity, proxy settings, and toolchain paths out of the sandbox.
Verify with a probe. Run a minimal test that attempts the denied operations and confirm they fail; a policy that is never exercised is a guess.
Track grants in version control. Store override files from /var/lib/flatpak/overrides and ~/.local/share/flatpak/overrides in a repo so drift is reviewable.

Architecture

Flatpak layers three isolation mechanisms. Bubblewrap builds the mount namespace and seccomp filter, the portal daemons mediate privileged operations through D-Bus, and the permission store records user decisions. Hardening means shrinking the bubblewrap grants and the portal allowlist together, because either one can reopen a path the other closed.

Production configuration

Audit and tighten a Flatpak app bash

flatpak info --show-permissions org.example.App
flatpak override --user --reset org.example.App
flatpak override --user \
  --filesystem=~/Documents:ro \
  --filesystem=/run/media:ro \
  --unshare=network \
  --no-talk-name=org.freedesktop.secrets \
  --unset-env=HTTP_PROXY \
  org.example.App
flatpak info --show-permissions org.example.App

Inspect the portal permission store bash

ls ~/.local/share/flatpak/db/
cat ~/.local/share/flatpak/db/permissions/org.example.App 2>/dev/null

Probe denied operations inside the sandbox bash

flatpak run --command=sh org.example.App -c '
  test -r /etc/shadow && echo "LEAK: shadow readable" || echo "ok: shadow blocked"
  dbus-send --session --dest=org.freedesktop.secrets --type=method_call /org/freedesktop/secrets org.freedesktop.DBus.Peer.Ping 2>&1 | head -1
'

Edge cases from production

Some apps crash when --socket=session-bus is removed because they use D-Bus for internal IPC; switch to --talk-name for the specific service they need.
Portal file choosers grant temporary access that persists in the permission store; revoke with flatpak permission-remove or by editing the store.
NVIDIA proprietary drivers require --device=dri and a matching runtime; removing device access breaks GL but is correct for software-rendered tools.
Overrides at system scope in /var/lib/flatpak/overrides override user scope silently; check both locations.

Questions fréquentes

Is Flatpak as secure as a container?

It is stronger than a native package but weaker than a full VM. The seccomp filter and namespace isolation are real, but portal mediation and broad grants often reopen the boundary.

How do I know which D-Bus names an app needs?

Run it with --socket=session-bus, capture the bus traffic with dbus-monitor, then convert the observed names into --talk-name grants.

Can I block all network access for a browser?

No, a browser needs network by definition. Restrict it to specific hosts with a local proxy or firewall rule instead.

Do overrides survive app updates?

Yes, overrides are stored separately from the app bundle and persist across updates, which is why they must be tracked in version control.

What is the safest default grant set?

No network, no session bus, read-only access to a single documents directory, and portals for everything else.

Comment Kinetikatech vous aide avec linux desktops and user land infrastructure

Vous ne devriez pas avoir à devenir expert en linux desktops and user land infrastructure : Hardening compositors, sandboxing desktop apps, and tuning the user land that developers and operators actually touch. C'est exactement à cela que sert Gestion de serveurs et Maintenance web : installation, durcissement, supervision et un ingénieur d'astreinte jour et nuit.

Parler à un ingénieur