From 7914cca31bc25db09c2e9719165a6b0e280d615d Mon Sep 17 00:00:00 2001 From: onyks-os <129986281+onyks-os@users.noreply.github.com> Date: Tue, 29 Sep 2026 09:28:05 +0200 Subject: [PATCH] fix(flatpak): show the status icon inside the sandbox ksni owns the StatusNotifierItem-PID-N name the specification asks for, and a Flatpak sandbox may not own it: the tray failed to start. Inside a sandbox it now registers with its unique name, which the watchers accept. The manifest grants talking to org.kde.StatusNotifierWatcher, and its comment no longer says notifications and the tray are missing. Co-Authored-By: Claude Opus 5.5 Signed-off-by: onyks-os <129986281+onyks-os@users.noreply.github.com> --- packaging/io.github.onyks_os.UsbguardGui.yaml | 5 +++-- src/ui/tray.rs | 8 +++++++- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/packaging/io.github.onyks_os.UsbguardGui.yaml b/packaging/io.github.onyks_os.UsbguardGui.yaml index 458815d..b9a8add 100644 --- a/packaging/io.github.onyks_os.UsbguardGui.yaml +++ b/packaging/io.github.onyks_os.UsbguardGui.yaml @@ -29,8 +29,9 @@ finish-args: - --system-talk-name=org.usbguard1 # --diagnose asks systemd whether usbguard.service is active (read-only). - --system-talk-name=org.freedesktop.systemd1 - # Notifications and the tray are not implemented yet; their permissions - # (ยง14.1) are added together with the features. + # The status icon (StatusNotifierItem). Notifications need no permission: + # GApplication sends them through the portal inside a sandbox. + - --talk-name=org.kde.StatusNotifierWatcher modules: - name: usbguard-gui diff --git a/src/ui/tray.rs b/src/ui/tray.rs index 6e7d9f1..14e1b02 100644 --- a/src/ui/tray.rs +++ b/src/ui/tray.rs @@ -100,7 +100,13 @@ pub(super) fn start(commands: Sender, reply: Sender) { total: 0, blocked: 0, }; - let result = tray.spawn().await.map_err(|e| e.to_string()); + // A sandbox cannot own the StatusNotifierItem-PID-N name the + // specification asks for; the watcher accepts the unique name. + let result = tray + .disable_dbus_name(super::autostart::sandboxed()) + .spawn() + .await + .map_err(|e| e.to_string()); let _ = reply.send(result).await; }); }