Alexander Larsson

I think we want to do this, but when its public API.

Flatpak does authentication using policykit, so the exact behavior depends on the configuration that your distribution ships. See e.g. `/usr/share/polkit-1/actions/org.freedesktop.Flatpak.policy` and `/usr/share/polkit-1/rules.d/org.freedesktop.Flatpak.rules`. The default files shipped with flatpak has for...

This is really weird. I've never seen it (and i'm on f31 with nvidia drivers). Can you run something like `strace -o signal.log -f -y flatpak -v run org.signal.Signal` and...

This is the failing part: ``` 20325 memfd_create("ld-so-conf", MFD_CLOEXEC|MFD_ALLOW_SEALING) = 17 20325 ftruncate(17, 41) = 0 20325 write(17, "/usr/lib/x86_64-linux-gnu/GL/def"..., 41) = 41 20325 lseek(17, 0, SEEK_SET) = 0 20325 fcntl(17,...

Oh: ``` EBUSY cmd is F_ADD_SEALS, arg includes F_SEAL_WRITE, and there exists a writable, shared mapping on the file referred to by fd. ```

But how could there be a mapping? We just created it and we didn't map it!

Just to isolate this, any chance you could boot into text-mode without the nvidia driver and see if this is reproducible?

Ugh, yeah, doubleplus ungood...

@tagoh so, we can easily map the contents of host /etc/fonts/conf.d somewhere in the sandbox and make the default config include that. The problem is more what is *in* the...

Fontconfig is problematic in general, because the configuration format is so complex (likely turing complete) and can do so many things with a weird dependency model where just just stack...