Classification: Filesystem Security & Runtime Sandboxing Status: Implemented & Verified

Executive Summary#

This report analyzes permission boundaries, filesystem isolation, and execution failures encountered when integrating sandboxed application formats (Flatpak and AppImage) with external storage vaults (such as /mnt/lacie). It details the diagnostic triage of permission denials, FUSE execution restrictions, and the decision to standardize core system tooling on native package management.

Threat Model & Problem Statement#

Application isolation frameworks (Flatpak, AppImage) provide sandboxing by restricting default access to the host filesystem. However, when operational workflows require direct access to designated storage mounts, isolated runtimes introduce specific operational failure modes:

  1. Strict Sandbox Traversal Blocks: Flatpak’s isolation restricts access across /mnt/ mount points by default. When an indexing script invokes an editor inside the sandbox, it generates silent Permission denied faults regardless of host POSIX file permissions.
  2. FUSE & Partition Mount Restrictions: AppImages require user-space FUSE runtime execution[cite: 6]. If destination storage partitions enforce noexec security flags, or if automated retrieval hits GitHub API rate limits, AppImages result in corrupted 0-byte binaries or silent runtime crashes.
  3. Operational Drag vs. Actual Risk: Introducing layered desktop sandboxes on a single-user, full-disk encrypted administrative workstation creates administrative friction without meaningfully improving the host security posture.

Diagnostic & Forensic Breakdown#

  • Incident: The primary documentation protocol (scribe) failed to invoke the Zettlr editor, returning persistent Permission denied errors against external storage paths.
  • Flatpak Failure: Identified that the Flatpak sandbox blocked traversal into /mnt/lacie. The package and its isolated runtime metadata were uninstalled:
flatpak uninstall --delete-data com.zettlr.Zettlr
  • AppImage Failure: Attempted AppImage deployment. Direct wget retrieval was throttled by API limits, and manually retrieved AppImage binaries failed to launch due to missing FUSE bridges and partition execution flags.

Remediation: Standardizing on Native Packaging#

To eliminate runtime permission conflicts across external mount boundaries, the application was migrated to native package management:

1. Native Package Deployment#

Installed the package natively via the system package manager (pacman), integrating directly with native system libraries and kernel POSIX permissions:

sudo pacman -Syu zettlr

2. Scribe Pipeline Patching#

Updated the operational wrapper script at /kairos/bin/scribe to invoke the native binary directly:

# Patched /kairos/bin/scribe
/usr/bin/zettlr "$@"

Operational Verification#

  • Vault Access: Verified read/write access across /mnt/lacie targets without permission faults.
  • Workflow Continuity: Confirmed CLI invocation scripts execute and launch the editor reliably.

Key Takeaway#

Sandboxing must match the operational threat model. Isolating network-facing browsers or untrusted binaries is essential, but applying rigid desktop sandboxes to local administrative and vault-indexing tools creates operational friction without improving host security.