Flatseal VS apparmor-profile-everything

And not only that, the idea of portals is, IMO, misguided. See this view/bugreport when a flatseal user understands that even though they restricted permissions to access a certain area, the flatpak, itself, can ask to open files there and if OK'd that will be allowed. Their expectation is that with the overrides say "no access" it means "no access even if the flatpak asks very nicely". https://github.com/tchx84/Flatseal/issues/196

Since you installed the programme via Flatpak, you should simply lack the necessary rights (https://docs.flatpak.org/en/latest/sandbox-permissions.html). You can extend the rights quite easily with https://github.com/tchx84/flatseal.

Yes, filed https://github.com/tchx84/Flatseal/issues/196 a while ago, got no joy.

One design feature than can turn into an issue in some scenarios (usually dev tools) is the permissions of a flatpak. In case I need to tweak things, I use Flatseal. I know you can manually do this from the command line but I don’t change permissions that often so I don’t bother learning how to do that.

Does the Flatpak Permissions Settings replace a tool like Flatseal?

What about flatseal then ? https://github.com/tchx84/Flatseal

https://github.com/tchx84/Flatseal (Also on Discover. For security reasons, the Discover store installs apps as sandboxed "flatpak" apps. This one is used to view what each up can do and change the permissions of apps. May be required if the sandboxing breaks something, though usually not required.)

I believe it does. As an example if I try running Godot from the Steam flatpak, it won't be able to see any of the contents of my ~/Projects folder unless I explicitly allow the steam flatpak access to that directory that via flatpak's CLI options or using Flatseal

Funny enough, the one the author contributes to. That's the idea behind apparmor-profile-everything and sandbox-app-launcher on Whonix and KickSecure, as far as I know (https://github.com/Whonix/apparmor-profile-everything and https://www.kicksecure.com/wiki/Sandbox-app-launcher )

https://github.com/Whonix/apparmor-profile-everything/graphs/contributors Author seems to be contributing to something AppArmor based for Whonix so I don't think they are unaware of it existing.

mr. /u/madaidan has done a fair bit of relevant work on Whonix and as you can see it is still far from "everything covered".