From a3aea60afca884953b832f65083ff57d302a8ecd Mon Sep 17 00:00:00 2001 From: Mateus Rodrigues Costa Date: Fri, 10 Jul 2026 15:07:00 -0300 Subject: [PATCH 1/3] flatpak: Tighten sandbox - Remove network permission - Add ipc permission - Replace broad devices permission with only dri and input permissions - Make filesystem permissions read-only (:ro) --- flatpak/io.github.hedge_dev.unleashedrecomp.json | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/flatpak/io.github.hedge_dev.unleashedrecomp.json b/flatpak/io.github.hedge_dev.unleashedrecomp.json index 5821bad23..db5a8c4fd 100644 --- a/flatpak/io.github.hedge_dev.unleashedrecomp.json +++ b/flatpak/io.github.hedge_dev.unleashedrecomp.json @@ -5,15 +5,16 @@ "sdk": "org.freedesktop.Sdk", "sdk-extensions" : [ "org.freedesktop.Sdk.Extension.llvm18" ], "finish-args": [ - "--share=network", + "--share=ipc", "--socket=wayland", "--socket=fallback-x11", "--socket=pulseaudio", - "--device=all", - "--filesystem=host", - "--filesystem=/media", - "--filesystem=/run/media", - "--filesystem=/mnt" + "--device=dri", + "--device=input", + "--filesystem=host:ro", + "--filesystem=/media:ro", + "--filesystem=/run/media:ro", + "--filesystem=/mnt:ro" ], "modules": [ { From 70ec1c3614a273101d806aa95364d3be04696385 Mon Sep 17 00:00:00 2001 From: Mateus Rodrigues Costa Date: Fri, 10 Jul 2026 16:27:06 -0300 Subject: [PATCH 2/3] flatpak: Re-add network permission --- flatpak/io.github.hedge_dev.unleashedrecomp.json | 1 + 1 file changed, 1 insertion(+) diff --git a/flatpak/io.github.hedge_dev.unleashedrecomp.json b/flatpak/io.github.hedge_dev.unleashedrecomp.json index db5a8c4fd..495e7363c 100644 --- a/flatpak/io.github.hedge_dev.unleashedrecomp.json +++ b/flatpak/io.github.hedge_dev.unleashedrecomp.json @@ -5,6 +5,7 @@ "sdk": "org.freedesktop.Sdk", "sdk-extensions" : [ "org.freedesktop.Sdk.Extension.llvm18" ], "finish-args": [ + "--share=network", "--share=ipc", "--socket=wayland", "--socket=fallback-x11", From 336dd58115904435c0044b0f1158b3a330a48e90 Mon Sep 17 00:00:00 2001 From: Mateus Rodrigues Costa Date: Fri, 10 Jul 2026 16:28:53 -0300 Subject: [PATCH 3/3] flatpak: Punch `~/.config/UnleashedRecomp` hole on sandbox --- flatpak/io.github.hedge_dev.unleashedrecomp.json | 1 + 1 file changed, 1 insertion(+) diff --git a/flatpak/io.github.hedge_dev.unleashedrecomp.json b/flatpak/io.github.hedge_dev.unleashedrecomp.json index 495e7363c..c749a2559 100644 --- a/flatpak/io.github.hedge_dev.unleashedrecomp.json +++ b/flatpak/io.github.hedge_dev.unleashedrecomp.json @@ -12,6 +12,7 @@ "--socket=pulseaudio", "--device=dri", "--device=input", + "--filesystem=xdg-config/UnleashedRecomp:create", "--filesystem=host:ro", "--filesystem=/media:ro", "--filesystem=/run/media:ro",