A Flatpak app starts in a sandbox with very limited access and gains reach only through permissions declared in its manifest. To judge an app, read those permissions and question the broad ones: host filesystem, the system or session bus, and all devices.
The default sandbox
According to the Flatpak documentation, apps by default cannot reach the network, host devices or processes outside the sandbox. They can own only their own D-Bus name, and they cannot use X11, the system bus or PulseAudio. Permissions are granted in the finish-args section of the build manifest, and they are static.
The permission groups
| Group | Examples from the docs | Question to ask |
|---|---|---|
| Standard | share=network, device=dri, socket=pulseaudio, socket=ssh-auth | Does the app need this for its job? |
| D-Bus | session-bus, system-bus | Why remove the bus filtering? |
| Filesystem | host, home, xdg-download, with :ro for read only | Can it be narrower or read only? |
| Devices | dri, kvm, shm, input, usb, all | Is all too broad? |
On D-Bus, the default allows an app to own names under its own app ID and talk to matching names, the bus itself, and portal interfaces. The documentation says --socket=system-bus and --socket=session-bus remove this filtering and are a security risk. On devices, it notes --device=all can reach webcams and optical drives.
What host access means
--filesystem=host grants access to all top level paths and subpaths of /, except certain reserved paths. Because host includes home, it also covers the home directory except ~/.var/app. The guidelines discourage broad grants like this in favor of narrower permissions or portals.
Portals as the alternative
Portals give controlled access to outside resources such as file choosers, opening URIs, printing and notifications. Often the user's action, like picking a file, is the permission. GTK3 and Qt5 support portals transparently, so many apps need no static filesystem access at all.
A quick review routine
- List the app's permissions before installing from a source you do not know well.
- Flag host, home, system bus, session bus and device all.
- Prefer an app that uses portals over one that asks for broad access.
- Revisit after updates, since permissions can change between versions.
- For apps you publish, grant the least that works and document why.
Try it yourself
Permissions are a form of dependency on the host. The inventory demo lists what an app contains and relies on. Click through it and compare that view with a permission list.
Click through it at your own pace, or open it full screen.
Quick check
Does a Flatpak sandbox make any app safe?
No. The sandbox limits reach, but broad permissions reduce that limit. An app with host access can touch most of your files.
Do portals need a permission in the manifest?
Often not. The documentation says the user's action, like choosing a file, can act as implicit permission.
Safeguard's SBOM and dependency scanning covers what ships inside the apps your team builds. A free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
