Description

Flatpak setup service executes as system users, such as SDDM and even root user.

Reproduce

I think using run0 manually and waiting for the service to trigger is enough. Also under the KDE image it triggered for SDDM system user.

Expected

Flatpak setup service should only run for regular user accounts. I think in general there are services that should only execute for real user. If you run0 and then systemctl --user there are other services as well that I don't think belong to system account and root user. For exmaple also podman-auto-update.timer.

Actual

It runs for sddm user and system user.

• Bloats the system with flatpak metadata.
• systemd-tmpfiles spam when during rpm-ostree apply-live, same as systemd-tmpfiles Refusing to set permissions on hardlinked file /var/lib/sddm/.local/share/flatpak/repo/objects/... ublue-os/bazzite#1579
• The setup is executed as root user, which means flatpak services execute as root user. This is in my opinion not ideal for security as it increases attack vector.

Sep 02 23:16:56 suika rpm-ostree[19655]: Refusing to set permissions on hardlinked file /var/lib/sddm/.local/share/flatpak/appstream/flathub-verified/x86_64/aec90a25ce3753e573426c7c99184584c0cd1471c6654bcd86dd232fc3a9a278/icons/64x64/tr.com.ikooskar.ikoOSKAR.png while the fs.protected_hardlinks sysctl is turned off.

The rpm-ostree problem is fixed with rm -fr -- /var/roothome/.local/share/flatpak /var/lib/sddm/.local/share/flatpak as root. I retain the secureblue-flatpak-setup.stamp file so the service does not trigger again.

Image

• https://github.com/secureblue/secureblue/blob/live/files/system/desktop/usr/lib/systemd/user/secureblue-flatpak-setup.service

Upstream

• n/a

Declaration

• I agree to follow this project's Code of Conduct.
• I declare that this is not a request for alternate community messaging or social platforms.
• I declare that I have read the secureblue website and my feature request is in-scope.