Desktop Linux Adventures: Override flatpak Permissions

I'm still running Linux (specifically Pop!_OS) on my main workstation. I started a little experiment in 2024 to run Linux as my main OS on the desktop for work. macOS still lives on the laptops, but that's because I dropped a lot of money on an M3-based MacBook Pro in late 2023 (when they were announced).

Anyway, in my day-to-day, Pop!_OS has been a great daily driver for my system. Everything works out of the box. Specifically, my CPU is a Xeon 3475X with 2 NVIDIA RTX A4000 GPUs. So, the system isn't something you just buy off of Best Buy. Therefore, I am impressed that a configuration as uncommon as mine works well 😎.

The Problem

To be transparent about my Linux skillz, I am competent enough around the command line, and I do know enough to be a little dangerous. However, I'm still not all too immersed into the ecosystem when it comes to packages just yet. I've been using Linux for over 15 years now, and I've been lucky enough to do either apt install or yum and be on with my day.

Occasionally, I do have to do some bespoke install process, but more or less, I get going.

This year in 2024 really felt like it was going to be the year of the Linux Desktop! Really! For most of the year so far, I've yet to experience many problems with any of the packages I install onto my system. Mostly everything will work the first time. This is such huge progress for the Linux platform as one of the things that has always prevented me from switching all the way has always been compatibility with a number of applications, or applications just not behaving as well as their Windows/macOS counterparts.

Turns out there are still some rough edges. In particular, package managers such as flatpak. To the uninitiated, flatpak may seem like other package managers like apt, but it is much different. The way I think of it is that it is similar to snap where the individual packages are isolated from the system. 

This isolation does sometimes poses a few gotchas/problems. For example, I was having a lot of issues in being able to send my wife some files over Skype, Slack and other messaging applications which were installed as flatpaks. 

Of course, I had a hunch as to the problem as I was familiar with the isolation concept. I knew that there was probably no allowed access to the filesystem for my specific user for these apps.

Solution

I did what any other dev would do and just looked up how to set permissions so that my Skype could actually allow me to send files. 🙈

Turns out the doc that helped me was about the flatpak override command here: https://docs.flatpak.org/en/latest/flatpak-command-reference.html#flatpak-override

So for example, you want to override some filesystem permissions for a flatpak package. You would first need to know which package name your app belongs to. A list of packages can be retrieved with this command:

flatpak list

Then we can just set permissions to have read-only on our users filesystem (specifically home directory) with this command given the flatpak package name:

flatpak override --user --filesystem=home:ro com.skype.Client

After executing the command, I just restarted Skype and tried sending files. All was well again!

In general, read the documentation for more options. 🙂

Overall...

I have been advocating that 2024 is the year of the Desktop Linux, but I still find little things like this are just killing those dreams! Why are we still performing these incantations to get our apps working correctly?

macOS does this right. It has these prompts to Disallow or Allow specific behaviors of an app as it attempts to perform actions they may need permissions for. 

Linux, let the user know this. The user may not have been as technical as me, and may be would have never figured it to be a permissions issue at all. Honestly, if I didn't have that knowledge, I would've just wiped Pop!_OS and just went back to Windows again. That would've ticked off yet another year where the Desktop Linux experiment failed. 

Please! consider the UX for these things!