- Flatseal is a graphical interface that allows you to manage the sandboxing of Flatpak applications without using the terminal.
- It allows granular access to specific folders, hardware devices, and network connections.
- It is essential to restart the application after modifying permissions for the changes to take effect.
- It includes a reset function to return to the original settings if the application stops working properly.
Sometimes we install an application using Flatpak, open it, and although the program seems to work perfectly, we realize that it can't access certain folders on an external hard drive or USB flash drive. This isn't because the software is broken; Flatpak's isolation or "sandbox" system is simply doing its job: preventing applications from accessing any part of our system without prior permission.
To avoid struggling with the terminal and complex commands, there's a tool called Flatseal. Essentially, it's a very intuitive graphical interface that lets us manage these permissions with just a few clicks, allowing us to open doors that are closed by default or, conversely, restrict access to applications we don't fully trust, thus strengthening our computer's security .
What exactly is Flatseal and how does it work?
Flatseal is a utility written in GTK3 that follows the GNOME aesthetic and whose main function is to act as a control panel for Flatpak applications. It's important to understand that Flatseal doesn't modify traditional Linux (Unix) permissions, but rather manages sandbox overrides . If you have a program installed via APT and it's not working, Flatseal won't help, as it only affects Flatpak packages.
The application presents a list of all installed software and allows you to adjust parameters such as network access, webcam usage , and the ability to run processes in the background. It is especially useful when an application doesn't properly utilize the "portals" (the standard desktop file selector) and you need to grant it persistent access to a specific path.
Steps to install Flatseal on Linux
The easiest way to obtain this tool is through Flathub. If you already have the system set up, simply run the following command in your terminal: flatpak install flathub com.github.tchx84.FlatsealYou can also find it easily search for "Flatseal" in your software store graph.
For more adventurous users who prefer to compile it from source code, they can clone the GitHub repository, install the necessary platforms and GNOME SDK, and use flatpak-builder to generate the application locally, although for the vast majority of mortals, the Flathub version is the most recommended and stable option.
How to manage permissions step by step
Before you start randomly flipping switches, it's advisable to know what permissions the app currently has. You can use the command flatpak info --show-permissions IDENTIFICADOR.DE.LA.APP For reference, although Flatseal already shows everything visually. To change a permission, the process is as follows:
- Close the application that you want to modify completely; if it remains in the background, the changes will not be applied.
- Open Flatseal and select the app in the left column.
- Go to the section File system.
- If you need access to a specific folder, add the path in "Other files" (for example: /mnt/Data/Photos).
- If you only want the app to read the files without modifying them, add the suffix :ro: at the end of the route.
- Restart the application and check that you can now access the files.
Guide to key permissions to avoid making a mistake
Not all switches mean the same thing, and activating everything can leave your system vulnerable. Here are the most important ones: `home` grants access to your entire home folder, which is very broad and best avoided if you only need a subfolder. On the other hand, `host` is the most powerful and dangerous option, as it grants access to a large part of the file system; it should be used as a last resort.
If you're looking for a more balanced approach, use the xdg-download, xdg-documents, or xdg-pictures options , which restrict access to standard user folders. Regarding hardware, the Devices option is necessary for controllers or cameras, while Network is essential for apps that require an internet connection, although you could disable it for tools you only use locally for greater privacy.
Troubleshooting and reverting changes
If after adjusting some settings the app starts behaving erratically or closes unexpectedly, don't worry. Flatseal has a reset button which leaves the permissions exactly as they were when you installed the app. You can also do this from the terminal with flatpak override --user --reset IDENTIFICADOR.DE.LA.APP.
There are situations where Flatseal isn't the solution. For example, if the external drive isn't mounted or if the Linux user doesn't have system-level read permissions for the folder, Flatseal won't work. It also doesn't fix problems with incompatible file formats or PipeWire audio server failures.
Managing application isolation allows us to balance functionality with security, preventing unknown software from accessing our entire digital life. Ideally, we should apply the principle of least privilege : grant only the strictly necessary permissions, restart the app, and verify the result before adding more exceptions.