Flatpak Permissions

I think /run/media and /mnt are sane defaults for common mounts, but does faugus really need to have access to the entire home? I know permissions are annoying, but giving an app access to everything, to avoid conflicts is just lazy. I don't know what faugus really needs to function properly.. mangohud read only? umu? lsfg? It doesn't have to be as strict as bottles, but maby something like how heroic does it?
No offense, I love the launcher and I think it's the best one available atm.
cheers.

[bayazidbh]

I think home access make sense. People have different sensibilities over where would they put their games. ~/Games is a common one, for example. But when my device has an HDD I'd mount it at ~/Storage and there would be a ~/Storage/Game for all the indie games not needing SSD speed.

Bottles take the opposite approach in that they go for minimal by default, but I don't think that make sense as I don't think that protect much from an actual malicious software and it just confuses people not already familiar with how Flatpak permission works.

And if you enable access to something like ~/Documents or ~/Downloads, you still expose a lot of user data. The line is either "very minimal and explicitly + clearly + unmissably tell users how to add it manually," or "just give entire home access and be done with it."

[FasterFall]

I think something like ~/Faugus should be whitelisted by default (which seems to be the path generated by default), and maybe Mangohud on read-only, and that's pretty much it.

If people want to have their games elsewhere, they can just change the permissions.

Also it does protect against malicious software as well accidental home wipes, obviously it's not 100% but it helps.

In addition this is outside the scope of this issue, but having something like Bottle's per instance sandbox (which also allows you to cut network), allowing the app only access to its own prefix, would be nice too.

[Oh-My-Lands]

@FasterFall not sure about sandboxing, but I blocked network access in Faugus with the help of firejail.

Go to Tools > Launch Arguments and then input:

firejail --net=none --noprofile

[mrbryo]

I kept getting a battle.net install failure. After a bit of research I presumed Faugus didn't have access to my second SDD. I used Flatseal to add my second SSD path to the filesystem permissions for Faugus. I suspect if I mounted it to a folder in my home folder I might not have needed to assuming it would have adopted the proper permissions from the home folder? Or not install the flatpak version. Anyway still learning Linux as a Windows replacement.

[cartag]

I'm having the same problem as @mrbryo. If I try to install anywhere other than ~/Faugus I can't do anything with battlenet. I don't have space in ~/ to install there.

[mrbryo]

@cartag I did resolve it using the application Flatseal by adding my gaming folder on my SSD globally for all flatpacks. Install Flatseal. Once you launch it click on All Applications at the top of the application list on the left side. Scroll down to Filesystem and add your path to your second drive under "Other files".

[SpinSemaphore]

(Edited: Figured out a few things.)

I used Flatseal to disable the "All user files" permission for the Faugus Launcher Flatpak. I then added the following directories to the existing list under "Other files" for Faugus:

~/Faugus:create
xdg-data/Steam:create
xdg-data/umu:create
xdg-data/applications
xdg-data/faugus-launcher:create

Added the following under Persistent:
faugus_temp

This worked to play an already installed copy of Guild Wars 2. Battle.net and WoW TBC installed fine with these settings.

WoW is a bit buggy when it comes to window management and fullscreen but I confirmed through testing that the flatpak directory permissions have nothing to do with that.

Hope this helps someone.