Flatpak reduce permissions

[ophiuchia 2]

Emby flatpak needs home system permissions. This is obvious since media files are typically in /home/user/

However, I don't like to give write permissions to any software that is exposed to the internet.

This is trivial to accomplish with the native package that runs as a separate 'emby' user. However, how can this accomplished with flatpak that runs as 'user'?

Thanks

 

 

[Luke 42078]

Hi, I've passed this along to our flatpak package developer to chime in and help answer this. Thanks.

[alucryd 315]

Hi @ophiuchia, I couldn't find any easy way to do this. It seems you can give it more permissions at runtime, and maybe downgrade existing ones a bit by passing `--filesystem=home:ro` to the flatpak run command (although the documentation isn't very clear whether it will work). By default the app has host read/write access btw, and actual permissions will of course be limited to what your current user can do.

I would suggest you create a separate user and run the flatpak as that sandboxed user, so that you can tweak exactly what permissions you want to give the process.

[ophiuchia 2]

Unfortunately was not able to make Emby flatpak work at this stage. However, allow me to share the opinion that it is fantastic to see an Emby flatpak release. I heavily use both projects separately.

My setup runs the EmbyServer on a Debian machine (.deb packages installed via gdebi).
I expect the EmbyServer to run as a separate user [this is solvable as per suggestion/but needs tweaking to prevent the user from having login rights] and to boot the EmbyServer with machine up [I did not have time to resolve this but may be doable].

I think the EmbyServer flatpak and .deb serve a different use-case at this stage (one is more for workstations one for remote server). However, I will follow this project closely in the hope to move to flatpak.

Is there any chance that you would also consider including EmbyServer in the official Debian repositories?

Thank you for the answers and your impressive work.

Edited February 6, 2022 by ophiuchia