flatpak: Add --share=network to fix synchronous gvfs connections

GVfs communicates with daemons over abstract sockets. Currently, synchronous
GIO API doesn't work for GVfs locations, because abstract sockets seem to be
blocked by sandbox permissions. This is not problem in most cases as Nautilus
uses asynchronous API usually. But this breaks e.g. "Empty Trash" functionality
as it is for some reason based on synchronous API.

In order to fix this problems, it is necessary to allow access to sockets
beginning with `unix:abstract=/dbus-vfs-daemon/socket-`, but I am not aware of
better way than adding `--share=network`, which allows access to all abstract
sockets:
http://docs.flatpak.org/en/latest/sandbox-permissions-reference.html#f2

Just a note that it is not clear to me, why it affects only the synchronous
API as the asynchronous API also uses abstract sockets. See the corresponding
Flatpak bug:
https://github.com/flatpak/flatpak/issues/2711
This commit is contained in:
Ondrej Holy 2019-03-07 12:23:58 +01:00 committed by Carlos Soriano
parent 83d2dd197f
commit 2e38753aed
3 changed files with 3 additions and 0 deletions

View file

@ -19,6 +19,7 @@ finish-args:
- "--filesystem=host"
- "--talk-name=org.gtk.vfs"
- "--talk-name=org.gtk.vfs.*"
- "--share=network"
- "--filesystem=xdg-run/dconf"
- "--filesystem=~/.config/dconf:ro"
- "--talk-name=ca.desrt.dconf"

View file

@ -19,6 +19,7 @@ finish-args:
- "--filesystem=host"
- "--talk-name=org.gtk.vfs"
- "--talk-name=org.gtk.vfs.*"
- "--share=network"
- "--filesystem=xdg-run/dconf"
- "--filesystem=~/.config/dconf:ro"
- "--talk-name=ca.desrt.dconf"

View file

@ -19,6 +19,7 @@ finish-args:
- "--filesystem=host"
- "--talk-name=org.gtk.vfs"
- "--talk-name=org.gtk.vfs.*"
- "--share=network"
- "--filesystem=xdg-run/dconf"
- "--filesystem=~/.config/dconf:ro"
- "--talk-name=ca.desrt.dconf"