Can not run flatpak apps after Kicksecure update

Support
21

Added a new wiki chapter to the security-misc wiki page just now:
Optional Features.

It’s suggesting to check optional features by security-misc (security related, commented-out by default sysctl and kernel parameters).

This includes kernel.unprivileged_userns_clone=0, user.max_user_namespaces=0.

Also added a link to that wiki chapter on the System Hardening Checklist wiki page just now.

The question arises, is it worth it? What’s better:

  • A) kernel.unprivileged_userns_clone=1 + sandbox enabled; OR
  • B) kernel.unprivileged_userns_clone=0 + sandbox disabled?
22

I do not know about appimage. For flatpak, I have been suspicious about their sandbox ever since I read flatkill website (https://flatkill.org/ and https://flatkill.org/2020/). Also see Linux | Madaidan's Insecurities.

Either way, today I started getting a warning saying that tor browser might not be as secure in my operating system configurations. This was because I set kernel.unprivileged_userns_clone=0 using previous instructions. See Security features warning links to Firefox installation support page with incomplete info (#43101) · Issues · The Tor Project / Applications / Tor Browser · GitLab and Install Firefox on Linux | Firefox Help.

I deleted /etc/sysctl.d/99-disable-unpriv-userns.conf (created using previous instructions), and now I do not get the warning. So I guess that is another reason to prefer kernel.unprivileged_userns_clone=1.

1 Like