liferooter / textpieces

Lines 117 to 123 in b14fd2c

    
                       /* Run script on host via 
        
                          `flatpak-spawn --host` 
        
                          if running in Flatpak */ 
        
                       if (!is_system && IN_FLATPAK.get ()) { 
        
                           cmdline += "flatpak-spawn"; 
        
                           cmdline += "--host"; 
        
                       }

Nice, but I wasn't aware of this until happening on that code. It makes possible a lot of tremendously useful custom tools I wasn't writing due to the false assumption that Text Pieces ran tools inside the flatpak sandbox environment. This also means it was unnecessary to loosen Text Pieces' flatpak sandbox permissions for the purpose of running tools that use scripts in ~/bin, nor was it necessary to copy helper programs into ~/.local/share/textpieces.

Given these significant power and security implications, could it please be documented somewhere outside of the code that the flatpak Text Pieces runs tools outside the flatpak sandbox, directly in the host OS environment?

Fixed in Text Pieces 4.0, which will be released soon

	/* Run script on host via
	`flatpak-spawn --host`
	if running in Flatpak */
	if (!is_system && IN_FLATPAK.get ()) {
	cmdline += "flatpak-spawn";
	cmdline += "--host";
	}

Document that tools run outside of the flatpak sandbox environment