Gain unprivileged access to an overlapped directory in Flatpak
Issue
/usr
and other hierarchies on the host cannot be accessed from Flatpak, because they conflict with the sandbox. Instead, you are presented with a fake, overlapped filesystem hierarchy. Currently, Flatpak alone has no working options to solve this issue, as configuration overrides have no effect on those special filesystem hierarchies. As Linux does not support directory hard links, this is a serious nuisance!
Solution
Luckily, there is a workaround to safely access the original directory without having root access, if your sysadmin (or you, if you own the system) installed the bindfs
package.
The bindfs
command uses a FUSE filesystem to mirror the contents of a directory to another directory:
bindfs /overlapped ~/.overlapped
If high performance is needed:
bindfs -o multithreaded /overlapped ~/.overlapped
If security (read-only access) is needed:
bindfs -o ro /overlapped ~/.overlapped
Example
TASK: access the documentation on a Debian system from a Flatpak app.
user@localhost:~$ mkdir .doc
user@localhost:~$ bindfs -o ro,multithreaded /usr/share/doc .doc
user@localhost:~$ ls .doc
…will grant you fast, read-only access to /usr/share/doc
by visiting .doc
in your user home.
ls .doc
will list the contents of /usr/share/doc
, while .doc
is not a symlink but a simple directory created by you.
You can now eg. use the Flatpak version of Mozilla Firefox to browse file:///home/yourusername/.doc
and it will let you read the files in /usr/share/doc
, which are normally inaccessible under Flatpak.
Note: this is not an official workaround, I've found by accident. If you know better alternatives please feel free to comment so other users can benefit. Thank you.
Tags: #linux #gnulinux #debian #flatpak #sandbox #virtualization #security #hacking #filesystem #fs #docs #sysadmin #sys #documentation