Shortwave Flatpak app Strange Behavior

Software
1

I did a whole system search on my Ubuntu derived OS laptop for a multimedia file I had grabbed a while ago, and I found mirroring of some content from my ~/Downloads in this folder:
/run/user/1000/doc/by-app/de.haeckerfelix.Shortwave/(A 32-bit integer)/Downloads/
Shortwave seems to be a popular web-radio app for mobile users so I am wondering why it is holding stuff from ~/Downloads in it’s own directory. The 32-bit hexadecimal integer named directory is probably not so strange but I didn’t want to publish it.
(edit)
I found more 32bit hexi addresses in /run/user/1000/doc/(hex32)/Downloads/ and other 32bit integer named directories in /run/user/1000/doc/ with a single audiobook mp3 or audiobook directory two with a single photograph.
Everything else in /run/user/1000/* seemed to be normal dbus dconf systemd type stuff.
(edit)

XXX@XXX:/run/user/1000/doc$ sudo rm -rf *
[sudo] password for XXX: 
rm: cannot remove '289998c': Permission denied
rm: cannot remove '637d1cf3': Permission denied
rm: cannot remove '68e446e9': Permission denied
rm: cannot remove '7a5a37c9': Permission denied
rm: cannot remove '84f8f841': Permission denied
rm: cannot remove '9e7dc346': Permission denied
rm: cannot remove 'by-app': Permission denied
XXX@XXX:/run/user/1000/doc$ ls -l 
ls: 289998c: Operation not supported
total 0
drwx------  2 XXX XXX 0 Jan  1  1970 289998c
dr-x------. 2 XXX XXX 0 Jan  1  1970 637d1cf3
dr-x------. 2 XXX XXX 0 Jan  1  1970 68e446e9
drwx------  2 XXX XXX 0 Jan  1  1970 7a5a37c9
drwx------  2 XXX XXX 0 Jan  1  1970 84f8f841
drwx------  2 XXX XXX 0 Jan  1  1970 9e7dc346
dr-x------  2 XXX XXX 0 Jan  1  1970 by-app
XXX@XXX:/run/user/1000/doc$ sudo su
root@XXX:/run/user/1000/doc# rm -rf *
rm: cannot remove '*': Permission denied
root@XXX:/run/user/1000/doc# exit
exit
2

I haven’t used flatpaks much.

It is my understanding, however, that if you have a flatpak that uses the xdg-document-portal it does this. It is, as I understand it, the preferred security methodology. From my understanding:

  1. This is basically a FUSE-mount access – basically the user-permission equivalent of a bind mount. The data isn’t duplicated … it basically has a reference to files under ~/Download
  2. The Shortwave app must have asked you for access to the ~/Download directory … through some sort of “File Chooser” dialog. This is where you are giving access permissions.
  3. Everything under /run is tmpfs and is removed/cleaned with every restart. That said, xdg-document-portal links might also be reestablished after restart. i.e. the access permission has permanence.

To deal with the access permission permanence you will need to use flatpak tools:

   flatpak permissions documents

Should give a list. You can revoke permissions with 'flatpak permission-remove documents [hashid]" where the hashid is as above.

1 Like