FlatPak (FlatHub) Application Installation - Destination Folder Path

[Royi]

Hello,
My preferred installation of applications is using FlatPak (FlatHub).

Yet there is something strange.
I use Software Manager to install FlatPak and it installs them on /var/lib/flatpak/app/ which is system wide folder.
The strange thing is Software Manager doesn't ask for Root Password to do so while for installation of other applications (Which goes system wide) it does.

What's going on here?

I'm on Linux Mint 18.3.

Thank You.

[xenopeek]

Flatpak uses polkit. Polkit (policy kit) is similar to sudo and gksudo in that it is a way to run a program with higher privileges but it offers a much finer level of control. As I read the policy file for Flatpak, normal users do not need authentication to install signed applications from signed repositories.

[Royi]

@xenopeek,
Could you show how do you understand that from the PolicyKit Files?

Thank You.

[xenopeek]

In the file /usr/share/polkit-1/actions/org.freedesktop.Flatpak.policy I find this snippet:

Code: Select all

  <action id="org.freedesktop.Flatpak.app-install">
    <!-- SECURITY:
          - Normal users do not need authentication to install signed applications
            from signed repositories, as this cannot exploit a system.
          - Paranoid users (or parents!) can change this to 'auth_admin' or
            'auth_admin_keep'.
     -->

I'm not sure about the rest of the file but if you're saying you don't need to provide your password to install Flatpaks, that seems to align with that comment.

[Royi]

Actually if you read the XML fields you;d see it requires Admin Auth.

I think it is in the other file which grants it permission.

[xenopeek]

You mean the /usr/share/polkit-1/rules.d/org.freedesktop.Flatpak.rules file? Yes you may be right. I'm not yet that deep into Flatpak configuration It looks to say if you're active & local user in sudo group, in waives your need to authorize with password (you could because you're in sudo group, but you don't because you're active & local user + above comment from the policy file).