If I globally disable filesystem access to home (i.e. filesystems=!home;), and an app declared that it needs home/some-dir, do I need to explicitly prevent access or do my global settings take precedence?
home/some-dir takes precedence.
More specific rules overrule general rules.
So I need to go look at what filesystem each app is requesting and manually disable that on top of disabling home access entirely? What’s the point of being able to do
filesystem=!homein the global config?
I don’t know the answer for sure, but think the global settings are like default settings. Each application can have different overrides. Not sure if the following is the correct quote to make, but sounds like this is how it works: https://docs.flatpak.org/en/latest/flatpak-command-reference.html#flatpak-override
flatpak-override — Override application requirements
If the application ID APP is not specified then the overrides affect all applications, but the per-application overrides can override the global overrides.
I assume you know Flatseal (GUI application for Flatpak permissions), right? After installation of a Flatpak app, you can go to the Flatseal settings and make sure to disable access if the application enabled anything you don’t like. I do not think there is an automatic way to force a specific setting for all applications. You have to deal with this per application. But I can be wrong here.
I’m asking global override vs application manifest (not application override). So the app asks for access to
home/some-dirbut I have a global override that blocks access to home entirely.
