fmaury/seirdy.one
1
0
Fork 0
mirror of https://git.sr.ht/~seirdy/seirdy.one synced 2024-11-23 12:52:10 +00:00
Code Issues Projects Releases Wiki Activity

New note: "Flatpak and web browsers"

Browse source
This commit is contained in:
Rohan Kumar 2022-06-12 16:24:50 -07:00
parent d9bbdaf4b2
commit 5cd1899f98
No known key found for this signature in database
GPG key ID: 1E892DB2A5F84479
1 changed files with 19 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
content/notes/flatpak-and-web-browsers.md Normal file
View file

@ -0,0 +1,19 @@
---
title: "Flatpak and web browsers"
date: 2022-06-12T16:24:49-07:00
replyURI: "https://floss.social/@alcinnz/108466919900074368"
replyTitle: "The outer layer will be via FlatPak"
replyType: "SocialMediaPosting"
replyAuthor: "Adrian Cochrane"
replyAuthorURI: "https://rhapsode.adrian.geek.nz/"
---
You might want to provision namespace-based isolation for your browsers. But that could throw a wrench into Flatpak-based distribution.
When distributing browsers through Flatpak, things get a bit...weird. Nesting sandboxes in Flatpak doesn't really work, since Flatpak forbids access to user namespaces.
For Chromium, they worked around this by patching Chromium zygote process (the process that provisions sandboxes) to call a Flatpak supervisor to create additional sandboxes. This is called the "spawn strategy". Chromium uses a two-layer sandbox: layer-2 is a syscall allow-list and layer-1 is everything else. The only problem is that Flatpak's layer-1 sandboxes are more permissive than Chromium's native layer-1 sandboxes, so the Chromium Flatpak has weaker sandboxing.
Firefox's sandboxing isn't entirely dependent on user namespaces, but it is weakened a bit without them; there's no "spawn strategy" implemented at the moment. More info is [on Bugzilla](https://bugzilla.mozilla.org/show_bug.cgi?id=1756236).
Now, whether this matters is something I can't decide for you. My personal opinion is that Flatpak serves as a tool to package, deliver, and sandbox native applications; Web browsers are tools that deliver and sandbox Web applications. Distributing a browser through Flatpak is like distributing Flatpak itself through Flatpak. Web browsers are an _alternative_ to Flatpak; they have their own sandboxing and updating mechanisms.