Repository: beeware/briefcase

Issue:
Poor default value for DBus access in Flatpak container
### Describe the bug

Originally reported by @sarayourfriend via security@beeware.org; we've determined that it isn't a security issue, and will instead be treating it as a normal bug fix.

---

Flatpak build target [defaults to including session bus permissions in the manifest](https://github.com/beeware/briefcase/blob/f468ca9177de50198f4ba7696f05eba5a6346310/src/briefcase/platforms/linux/flatpak.py#L143)

However, Flatpak's documentation says that including session bus access [breaks sandboxing and presents a security risk](https://docs.flatpak.org/en/latest/sandbox-permissions.html#d-bus-access).


### Steps to reproduce

1. Generate a hello world app for Flatpak
2. Check the Flatpak manifest.yml for the list of permissions


### Expected behavior

Briefcase-generated Flatpak apps shouldn't include the "socket=session-bus" permission by default.

### Screenshots

_No response_

### Environment

- Operating System: Linux (all)
- Python version: all
- Software versions:
  - Briefcase: 0.3.20


### Logs

```

```


### Additional context

While the Flatpak documentation indicates that adding Dbus access poses a security risk, in order to exploit this fact, an app would need to either:

1. Explicitly be trying to access DBus in application code - in which case the app author themselves are the party being malicious
2. Include a dependency that tries to access DBus in an inappropriate way - this constitutes a supply chain attack, with Flatpak providing, at best, a layer of protection
3. Include a code injection exploit in the app's code - in which case DBus access is the least of your problems.

In all three cases, the same app code published as a system package would have *no* protection; so Flatpak with the extra permission would have the same defect as an app packaged as a system package.

On that basis, we *don't* consider this a security issue, but a default value for Flatpak packaging that can be improved.

We’ve identified that the permission was added because a test app that was used to verify Flatpak packaging (Toga Tutorial 4) was slightly misconfigured - the Briefcase bundle ID and the ID in the Toga code didn’t match, and as a result, the Flatpak app wasn’t able to access it’s own DBus session. Giving access to the system bus resolved this issue - because it gave access to the *whole* of DBus. 


Discussion:

Patch:
diff --git a/changes/2074.removal.rst b/changes/2074.removal.rst
new file mode 100644
index 00000000..4900e597
--- /dev/null
+++ b/changes/2074.removal.rst
@@ -0,0 +1,1 @@
+Flatpak apps no longer request D-Bus session access by default. Most apps have no need to access the D-Bus session, unless they're a development tool that is inspecting D-Bus messages at runtime. If you experience errors related to this change, it is likely caused by an inconsistency between the ``bundle`` definition in your app configuration, and the way the app describes its bundle ID at runtime. If you *do* require D-Bus access, adding ``finish_arg."socket=session-bus" = true`` to the Flatpak configuration for your app will restore D-Bus session access.
diff --git a/src/briefcase/platforms/linux/flatpak.py b/src/briefcase/platforms/linux/flatpak.py
index 563248b0..6c8f14a4 100644
--- a/src/briefcase/platforms/linux/flatpak.py
+++ b/src/briefcase/platforms/linux/flatpak.py
@@ -139,8 +139,6 @@ class LinuxFlatpakCreateCommand(LinuxFlatpakMixin, CreateCommand):
             "filesystem=xdg-config": True,
             "filesystem=xdg-data": True,
             "filesystem=xdg-documents": True,
-            # DBus access
-            "socket=session-bus": True,
         }
 
         finish_args.update(getattr(app, "finish_arg", {}))


Test patch:
diff --git a/tests/platforms/linux/flatpak/test_create.py b/tests/platforms/linux/flatpak/test_create.py
index b2d748df..8b37e7c9 100644
--- a/tests/platforms/linux/flatpak/test_create.py
+++ b/tests/platforms/linux/flatpak/test_create.py
@@ -54,7 +54,6 @@ DEFAULT_FINISH_ARGS = {
     "filesystem=xdg-config": True,
     "filesystem=xdg-data": True,
     "filesystem=xdg-documents": True,
-    "socket=session-bus": True,
 }
 
 
@@ -89,7 +88,6 @@ DEFAULT_FINISH_ARGS = {
                     "filesystem=xdg-config": True,
                     "filesystem=xdg-data": True,
                     "filesystem=xdg-documents": True,
-                    "socket=session-bus": True,
                     "allow=bluetooth": True,
                 },
             },
@@ -221,7 +219,6 @@ DEFAULT_FINISH_ARGS = {
                     "filesystem=xdg-config": True,
                     "filesystem=xdg-data": True,
                     "filesystem=xdg-documents": True,
-                    "socket=session-bus": True,
                     "allow=bluetooth": True,
                 },
             },