Flatpak has become one of the premier application distribution standards across the Linux ecosystem, enabling Ubuntu users to install current software packages—from Obsidian and Steam to Discord and VLC—without polluting system libraries or risking dependency conflicts. At the core of Flatpak’s architecture is Bubblewrap sandboxing, which isolates running applications from your underlying operating system, host filesystem, and hardware devices.
However, this strict sandboxing can introduce practical frustrations. A media player may lack permission to access music stored on your secondary internal drive or external USB storage; a graphics tool may be blocked from your camera; or conversely, an untrusted proprietary chat client might possess unrestricted read access to your entire user home directory. To solve these permission conflicts effortlessly without memorising complex command-line overrides, Ubuntu users rely on Flatseal. In this guide, we explore how to install Flatseal, inspect application privileges, grant external drive access, and reset permissions safely.
Understanding Flatpak Sandbox Permissions
Flatpak organizes sandbox restrictions across distinct security domains, all of which Flatseal surfaces through an intuitive graphical dashboard:
| Permission Domain | Default Behaviour | Common Failure Symptom | Flatseal Adjustment |
|---|---|---|---|
| Filesystem Access | Restricted to application runtime sandbox directory | Cannot open files on external USB or secondary HDD | Add /media, /mnt, or specific path under Other files |
| Socket Communication | Restricted to Wayland or X11 display servers | Cannot share screens or pipe audio streams | Toggle Wayland, X11, or PulseAudio sockets |
| Device Access | Direct hardware GPU/Camera/USB access blocked | Webcam unrecognised in video conferencing app | Toggle All devices or Camera permissions |
| Network Access | Configured per application manifest | Local network printer or DLNA server unreachable | Enable Network or restrict offline tools |
If you are exploring diverse packaging formats on Linux, review our guide on how to use Snap, Flatpak and AppImage on Ubuntu to understand the architectural differences between runtime sandboxes.
Step-by-Step Tutorial: Installing Flatseal on Ubuntu
Because Flatseal is itself packaged as a Flatpak, installing it is straightforward once the Flatpak runtime is enabled on your Ubuntu machine:
- Open the Terminal on Ubuntu (press
Ctrl + Alt + T). - Ensure Flatpak and the Flathub repository are active by running:
sudo apt update && sudo apt install flatpakflatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo - Install Flatseal directly from Flathub by executing:
flatpak install flathub com.github.tchx84.Flatseal - Press Y to confirm the installation when prompted.
- Once complete, launch Flatseal from the Ubuntu application grid or by running
flatpak run com.github.tchx84.Flatseal.
Granting Access to External USB Drives and Custom Directories
The single most frequent reason Ubuntu users need Flatseal is resolving "Permission Denied" errors when trying to open files stored outside their default home directory:
- Launch Flatseal. The left-hand panel lists every Flatpak application installed on your system.
- Click on the specific application experiencing issues (for example, VLC or GIMP).
- In the main right-hand window, scroll down to the Filesystem section.
- Notice the built-in toggles: All system files, All user files, and Other files.
- To allow the app to browse external drives without giving it access to your entire root partition, locate Other files, click the + (Add) button, and type:
/media - Add a second entry for secondary fixed drives if needed:
/mnt - Restart the target application. It will now seamlessly browse and open media files stored on any connected USB stick or external drive.
Hardening Security: Revoking Unnecessary Permissions
Flatseal works equally well in reverse to restrict proprietary software from accessing private files:
- Block Home Folder Access: If an application only needs to read its own configuration files, toggle off All user files under the Filesystem section.
- Disable Network Access for Offline Utilities: If you use an image editor or text processor that does not need internet connectivity, scroll to the Network section and toggle off Network to prevent telemetry.
- Reset Permissions to Defaults: If you ever make a configuration mistake that prevents an application from starting properly, select the app in Flatseal and click the Reset button in the top-right corner to revert all settings to factory defaults.
- For regular storage housekeeping, you can also safely clean up disk space in Ubuntu Linux to remove unreferenced runtime layers.
Frequently Asked Questions
Does Flatseal modify permissions for native DEB or Snap packages?
No. Flatseal is specifically designed to manage Bubblewrap sandbox policies for Flatpak applications. It cannot modify permissions for traditional APT packages or Canonical Snap packages.
Can Flatseal break my installed applications?
Revoking critical sockets (such as display servers or audio backends) can prevent an application from rendering a GUI or playing sound. However, this causes no permanent system damage; clicking the Reset button in Flatseal instantly restores the app to its original working state.
Do permission changes in Flatseal persist after software updates?
Yes. Flatseal stores user overrides in ~/.local/share/flatpak/overrides/. When Flatpak updates an application to a newer version, your personal overrides remain preserved automatically.