flatpak: add :create to data-dir filesystem grants so first-run persists
What the developer wrote
Authored by Dan Miller
flatpak: add :create to data-dir filesystem grants so first-run persists
What changed, and why it matters
This change updates three Flatpak app permission files so the apps can create their own data folders (like ~/.stackwallet) on first launch. Previously, the apps could only access those folders if they already existed, which could cause first-run setup to fail. The change is a sandbox permission tweak, not a fix for a code vulnerability.
No immediate security action required. Review whether the :create grant is the least-privilege way to solve the first-run persistence issue; consider creating the directory at install time instead if stricter sandboxing is desired.
Security signals we found
Flatpak sandbox permission change
Filesystem grant broadened from access-only to create
No code-level vulnerability patched
Evidence from the diff
The commit appends the :create suffix to –filesystem= grants in three Flatpak manifests (campfire, stackduo, stackwallet). In Flatpak, :create allows the sandboxed app to create the directory if it does not already exist. Without :create, the runtime may fail to persist initial configuration or wallet data on first launch. This is a packaging/sandboxing fix for a functional bug, not a memory safety, cryptographic, or authentication issue.
Changed components
flatpak/com.cypherstack.campfire.yamlflatpak/com.cypherstack.stackduo.yamlflatpak/com.cypherstack.stackwallet.yamlInspect captured patch +3 / −3
diff --git a/flatpak/com.cypherstack.campfire.yaml b/flatpak/com.cypherstack.campfire.yaml
index 9f8cd9e..6dfcca8 100644
--- a/flatpak/com.cypherstack.campfire.yaml
+++ b/flatpak/com.cypherstack.campfire.yaml
@@ -10,7 +10,7 @@ finish-args:
- --socket=fallback-x11
- --socket=wayland
- --device=dri
- - --filesystem=~/.campfire
+ - --filesystem=~/.campfire:create
- --talk-name=org.freedesktop.secrets
- --talk-name=org.freedesktop.Notifications
diff --git a/flatpak/com.cypherstack.stackduo.yaml b/flatpak/com.cypherstack.stackduo.yaml
index 195f674..8b6b742 100644
--- a/flatpak/com.cypherstack.stackduo.yaml
+++ b/flatpak/com.cypherstack.stackduo.yaml
@@ -10,7 +10,7 @@ finish-args:
- --socket=fallback-x11
- --socket=wayland
- --device=dri
- - --filesystem=~/.stackduo
+ - --filesystem=~/.stackduo:create
- --talk-name=org.freedesktop.secrets
- --talk-name=org.freedesktop.Notifications
diff --git a/flatpak/com.cypherstack.stackwallet.yaml b/flatpak/com.cypherstack.stackwallet.yaml
index f8836e6..4bdaa87 100644
--- a/flatpak/com.cypherstack.stackwallet.yaml
+++ b/flatpak/com.cypherstack.stackwallet.yaml
@@ -10,7 +10,7 @@ finish-args:
- --socket=fallback-x11
- --socket=wayland
- --device=dri
- - --filesystem=~/.stackwallet
+ - --filesystem=~/.stackwallet:create
- --talk-name=org.freedesktop.secrets
- --talk-name=org.freedesktop.Notifications
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.