Making Fedora usable for nonwheel users

[siosm (Timothée Ravier)]

@boredsquirrel

I never heard of that… does it have similar restrictions like GNOME Boxes Flatpak, where USB device access or TPM doesnt work?

Yes, this is what GNOME Boxes uses.

@boredsquirrel

I also dont understand why accessing libvirtd grants root on the host system.

See: 1284447 – libvirt group is unauthenticated root equivalent.

There are “options” to escalate from system libvirtd access to full root on a system.

@boredsquirrel

I think Fedora defaults to adding users to the Flatpak group?

No. Fedora defaults to system installed Flatpaks.

@boredsquirrel

There is no security benefit

Any (in)security claim must come with a threat model otherwise they are security theater.

@boredsquirrel

Also user Flatpaks cant do certain privileged things, like GPU screen recorder. But that is an edge case and I dont fully understand the mechanism.

The installation location does not determine what a Flatpak application can do. Neither system installed Flatpaks nor user installed ones can do privileged operations.

@boredsquirrel

On restricted systems

This is not the default use case for Fedora. This requires configuration.