fcitx stop working at flatpak 1.0.0

[nakamuray]

Linux distribution and version

ubuntu 18.04

Flatpak version

1.0.0 (from ppa:alexlarsson/flatpak)

Description of the problem

After upgrading flatpak from 0.99.3 to 1.0.0, I can't input japanese characters on slack app.
While fcitx (mozc) is activated (input method indicator is apeard around cursor), typing keyboard has no effect.
Downgrading to 0.99.3 bring back to expected behavior.

Steps to reproduce

1. setup fcitx on host side
2. install slack app from flathub and run it
3. activate fcitx (mozc) and type something

[alexlarsson]

Hmm, this is probably due to a small change in how the dbus proxy works that was made to future proof the portals. In particular, this commit: ef9297a

We used to allow sandboxed apps to receive all broadcasts from portals, but we now limit them to those under the /org/freedesktop/portal object path. I wonder if the fcitx portal was using this? If so, it would need to change the broadcast object paths.

[nakamuray]

I confirmed that at least on flatpak 1.0.0 without ef9297a (rebuild deb package with patch which revert the commit), fcitx works as expected.

[alexlarsson]

I realize this is a breaking change, but its unfortunately required for security reasons. However, it should be fixable, and If you have patches to fcitx I can apply them in the runtimes.

[trulyliu]

I am also affected by this issue.
Should we patch fcitx? How?

[nanonyme]

@alexlarsson if we need changes in freedesktop-sdk, we should probably have a copy of this on that side, right?

[nanonyme]

Opened https://gitlab.com/freedesktop-sdk/freedesktop-sdk/issues/728 so this gets tracked on runtime-side as well.

[Areiser]

I'm glad this is receiving attention. I still can't use Anki because I can't input vocabulary.

[alexlarsson]

So, I'm not sure exactly what needs to change, because I don't know exactly how fcitx clients talk to the fcitx portal daemon. However, what changed was a detail in which dbus messages was allowed by default.

It used to be the case that all direct messages to any dbus names called org.freedesktop.portal.* were allowed to be sent, and all broadcasts message from the same names are allowed to be received by the sandboxed. However, in later versions of flatpak the later has changed. Any broadcast from org.freedesktop.portal.* must now have an object path starting with /org/freedesktop/portal for it to be received by the sandboxed app.

[alexlarsson]

If you want to see what fcitx does, run dbus-monitor --session while running whatever is not working.
Alternatively you can flatpak run --log-session-bus ..., although the output from that isn't super-easy to understand.

[nanonyme]

Maybe whoever can reproduce this should just collect the output and attach here for further analysis?

[daotrunghieu]

Hello,

I'm using fcitx as my input method and I found an approach helps me type freely in flatpak applications has runtime: org.kde.Platform/x86_64/5.12

$ flatpak --user override --talk-name=org.fcitx.Fcitx --talk-name=org.freedesktop.portal.Fcitx <app-id>
or
$ flatpak --user override --socket=session-bus <app-id> (too much?)

In my system (flatpak-1.2.4-1.fc29), three applications were tested: com.slack.Slack; net.ankiweb.Anki; org.telegram.desktop.

[nanonyme]

The latter is definitely too much, it's a blanket permission for granting access to everything in session bus.

[magiruuvelvet]

I just tested flatpak --user override --talk-name=org.fcitx.Fcitx --talk-name=org.freedesktop.portal.Fcitx <app-id> on some apps and it works great. Thanks for figuring this out ❤️

I'm on Arch Linux running the latest flatpak.

[nanonyme]

@alexlarsson what's your opinion? Should apps that are most affected by this issue just be changed to request this permission? Do all apps need it?

[daotrunghieu]

I double-check experiments on another apps, I have the outcome that adding
--talk-name=org.freedesktop.portal.Fcitx
is enough to let those apps work with fcitx:

• chat.rocket.RocketChat
• com.visualstudio.code
• com.mattermost.Desktop
• im.gitter.Gitter

and none succeeded:

• com.spotify.Client
• io.ark.Desktop

This is the output when run flatpak run --log-session-bus
logs.tar.gz

[Mikaela]

I confirmed that Riot, Telegram, Discord and Gajim also work when that is added and I sent pull requests as this issue has bothered me a lot with them especially with backticks and code blocks. Thank you everyone involved in finding what was wrong 💜

[alexlarsson]

A --talk-name=org.freedesktop.portal.Fcitx will fix this because that is a wider permission than what the default portal one is.

However, this is a security regression and should not be merged, as it just papers over the real problem which will then not be fixed, and will need every app to be modified with a hack that will be copied around forever.

[alexlarsson]

Basically, the fix is that all the broadcast messages that the fcitx daemon sends have to use a object path that starts with /org/freedesktop/portal.

[nanonyme]

Looks like there actually is a relevant upstream ticket at https://gitlab.com/fcitx/fcitx/issues/429

[trulyliu]

flatpak --user override --talk-name=org.fcitx.Fcitx --talk-name=org.freedesktop.portal.Fcitx com.skype.Client
make skype works.

[BjoernDaase]

I have the exact same problem in all my Jetbrains IDEs. Unfortunately, flatpak --user override --talk-name=org.fcitx.Fcitx --talk-name=org.freedesktop.portal.Fcitx com.jetbrains.Webstorm (or any other application of those) does not make the dead keys work again. Any ideas?

OS: Fedora 31

[nanonyme]

This is a bug in fcitx. They seem to have removed means to contribute fixes to the project though so I'm not sure this will ever be fixed. They also removed issue tracker on fcitx. I'm not sure the project is alive anymore.

[wengxt]

Just pushed relevant fix, need to check if that's the only change need to make fcitx/fcitx@1f4c3a9

[nanonyme]

@wengxt note, regarding compatibility: the server part is shipped by distro while the library is shipped through Flatpak runtime. It's most likely not possible to be compatible but current situation is broken anyway pretty much everywhere.

[nanonyme]

Thank you and sorry for above. I jumped to conclusions from repo configuration

[nanonyme]

The fix by @wengxt is now integrated into all active freedesktop-sdk branches. It will be released Soon (tm) for 18.08 and 19.08.

[nanonyme]

Note we realized that Gnome runtime is shipping a separate fcitx version so assuming all goes well with the freedesktop-sdk release, attention needs to next be focused into https://gitlab.gnome.org/GNOME/gnome-build-meta/issues. KDE should end up getting fixed by itself after a rebuild.

[refi64]

To be clear, what else here needs to be done? Is it just pending a new fcitx server release with the linked commit?

[Quintasan]

I am not sure if this is related but I can't even activate fcitx in Slack using the default Ctrl+Space combo.

I have run flatpak --user override --talk-name=org.fcitx.Fcitx --talk-name=org.freedesktop.portal.Fcitx com.slack.Slack

which then I verified by running

~ ➜ flatpak --user override --show com.slack.Slack
[Session Bus Policy]
org.freedesktop.portal.Fcitx=talk
org.fcitx.Fcitx=talk

so my flatpak should have the appropriate permissions to talk to Fcitx. Fcitx itself works just fine on the host itself. Is there anything I missed?

[Mikaela]

Have you restarted Slack after adding the override? That is the only step you don't mention that I can see you as missing.

[Quintasan]

I did not mention that but of course I did restart Slack :) pt., 7 lut 2020, 22:38 użytkownik Mikaela Suomalainen < notifications@github.com> napisał:

…

Have you restarted Slack after adding the override? That is the only step you don't mention that I can see you as missing. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#2031?email_source=notifications&email_token=ABR4P7KL6JPAGQMCF5KLGJ3RBXIFNA5CNFSM4FR4BROKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOELEWX4I#issuecomment-583625713>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABR4P7P3I7PMDP5OORYCBQ3RBXIFNANCNFSM4FR4BROA> .

[yutouyes]

The trick flatpak --user override --talk-name=org.fcitx.Fcitx --talk-name=org.freedesktop.portal.Fcitx <app id> doesn't work in Crostini(Chrome OS). Tested in Firefox and vscode.

[luni3359]

The trick flatpak --user override --talk-name=org.fcitx.Fcitx --talk-name=org.freedesktop.portal.Fcitx <app id> doesn't work in Crostini(Chrome OS). Tested in Firefox and vscode.

Your fcitx needs to be on version 4.2.9.7 to work with flatpak.

[yutouyes]

The trick flatpak --user override --talk-name=org.fcitx.Fcitx --talk-name=org.freedesktop.portal.Fcitx <app id> doesn't work in Crostini(Chrome OS). Tested in Firefox and vscode.

Your fcitx needs to be on version 4.2.9.7 to work with flatpak.

I've upgraded fcitx to 4.2.9.7-3 but still broke. Is everything ok in your crostini?

[wengxt]

The trick flatpak --user override --talk-name=org.fcitx.Fcitx --talk-name=org.freedesktop.portal.Fcitx <app id> doesn't work in Crostini(Chrome OS). Tested in Firefox and vscode.

Your fcitx needs to be on version 4.2.9.7 to work with flatpak.

I've upgraded fcitx to 4.2.9.7-3 but still broke. Is everything ok in your crostini?

I just tried firefox from flathub on archlinux and everything works fine. So probably you just had a regular fcitx configuration problem? BTW, no "talk-name" argument is required anymore.

Try set GTK_IM_MODULE before run flatpak, also see https://fcitx-im.org/wiki/Configure_(Other)

[yutouyes]

The trick flatpak --user override --talk-name=org.fcitx.Fcitx --talk-name=org.freedesktop.portal.Fcitx <app id> doesn't work in Crostini(Chrome OS). Tested in Firefox and vscode.

Your fcitx needs to be on version 4.2.9.7 to work with flatpak.

I've upgraded fcitx to 4.2.9.7-3 but still broke. Is everything ok in your crostini?

I just tried firefox from flathub on archlinux and everything works fine. So probably you just had a regular fcitx configuration problem? BTW, no "talk-name" argument is required anymore.

Try set GTK_IM_MODULE before run flatpak, also see https://fcitx-im.org/wiki/Configure_(Other)

I've set that and fIrefox from apt-get can catch fcitx correctly. I'm not sure if it's the problem of crostini or just my mistake because before flatpak, snap also came to an error cannot update snap namespace: cannot create writable mimic over "/usr/share/" which is not reported in the community. Your archlinux is running in crostini right?

[teohhanhui]

Looks like kimpanel also has the same problem:

$ dbus-monitor --session

signal time=1592751473.282050 sender=:1.93 -> destination=(null destination) serial=1221311 path=/kimpanel; interface=org.kde.kimpanel.inputmethod; member=ShowAux
   boolean false
signal time=1592751473.282057 sender=:1.93 -> destination=(null destination) serial=1221312 path=/kimpanel; interface=org.kde.kimpanel.inputmethod; member=ShowPreedit
   boolean false
signal time=1592751473.282072 sender=:1.93 -> destination=(null destination) serial=1221313 path=/kimpanel; interface=org.kde.kimpanel.inputmethod; member=ShowLookupTable
   boolean false

This seems to be something that needs to be fixed on Flatpak side, instead of expecting everybody else to change their paths?

Edit: Hmm... Sorry, I actually have no idea if this is the cause.