fedora-kde / SIG

#157 Silverblue: Using flatpak via SSH creates multiple password prompts
Closed: Won't fix by siosm. Opened by decfi.

Closed: Won't fix
Reopen Issue

systemctl start sshd

ssh $USER@localhost

flatpak search test

 ==== AUTHENTICATING FOR org.freedesktop.Flatpak.metadata-update ====
 ==== AUTHENTICATING FOR org.freedesktop.Flatpak.appstream-update ====

Changing polkit rules in /etc/polkit-1/rules.d/org.freedesktop.Flatpak.rules has no effect.
https://github.com/flatpak/flatpak/issues/3001
https://bugs.launchpad.net/ubuntu/+source/flatpak/+bug/1847339

I can reproduce on Kinoite (thus why this is filed here for tracking).

Metadata Update from @siosm:
- Issue set to the milestone: Future Release
- Issue tagged with: flatpak, kinoite

For the record, this issue happens on the normal edition of KDE and not just Kinoite

This is due to the default polkit configuration:

$ cat /usr/share/polkit-1/rules.d/org.freedesktop.Flatpak.rules
polkit.addRule(function(action, subject) {
    if ((action.id == "org.freedesktop.Flatpak.app-install" ||
         action.id == "org.freedesktop.Flatpak.runtime-install"||
         action.id == "org.freedesktop.Flatpak.app-uninstall" ||
         action.id == "org.freedesktop.Flatpak.runtime-uninstall" ||
         action.id == "org.freedesktop.Flatpak.modify-repo") &&
        subject.active == true && subject.local == true &&
        subject.isInGroup("wheel")) {
            return polkit.Result.YES;
    }
    return polkit.Result.NOT_HANDLED;
});
polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.Flatpak.override-parental-controls") {
            return polkit.Result.AUTH_ADMIN;
    }
    return polkit.Result.NOT_HANDLED;
});

You can write an "override" rule to make it possible to manage system flatpak password less remotely with:

$ cat /etc/polkit-1/rules.d/org.freedesktop.Flatpak.rules
polkit.addRule(function(action, subject) {
    if ((action.id == "org.freedesktop.Flatpak.app-install" ||
         action.id == "org.freedesktop.Flatpak.runtime-install"||
         action.id == "org.freedesktop.Flatpak.app-uninstall" ||
         action.id == "org.freedesktop.Flatpak.runtime-uninstall" ||
         action.id == "org.freedesktop.Flatpak.modify-repo") &&
        subject.active == true &&
        subject.isInGroup("wheel")) {
            return polkit.Result.YES;
    }
    return polkit.Result.NOT_HANDLED;
});

Metadata Update from @siosm:
- Issue close_status updated to: Won't fix
- Issue status updated to: Closed (was: Open)

Closing as it's by design.
Metadata
None

flatpak kinoite

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.