flatpak 1.0.6 release.
This release fixes an issue that lets system-wide installed applications create setuid root files inside their app dir (somewhere in /var/lib/flatpak/app). Setuid support is disabled inside flatpaks, so such files are only a risk if the user runs them manually outside flatpak.
Installing a flatpak system-wide is needs root access, so this isn't a privilege elevation for non-root users, and allowing root to install setuid files is something all traditional packaging systems allow. However flatpak tries to be better than that, in order to make it easier to trust third party repositories.
Changes in this version:
sudo dnf upgrade --refresh --advisory=FEDORA-2018-2f9521c82e
Please login to add feedback.