From 3eec43054c0278005f9a83f4909acb4f834b53e0 Mon Sep 17 00:00:00 2001
From: secretmango <78762110+secretmango@users.noreply.github.com>
Date: Fri, 12 Jun 2026 02:50:09 +0200
Subject: [PATCH] Flatpak: harden default permissions

This way the application only has static access to it's own folder, an empty folder in Downloads and read-only access to the user's music folder.

Direct rendering access was removed as it is not needed for the app to run.
---
 packaging/flathub/org.amule.aMule.yaml | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/packaging/flathub/org.amule.aMule.yaml b/packaging/flathub/org.amule.aMule.yaml
index bed79b4b4d..9e533689ac 100644
--- a/packaging/flathub/org.amule.aMule.yaml
+++ b/packaging/flathub/org.amule.aMule.yaml
@@ -51,14 +51,13 @@ finish-args:
   - --share=ipc
   - --socket=fallback-x11
   - --socket=wayland
-  - --device=dri
-  # Full home access. aMule is a P2P client where users mark arbitrary
-  # folders as shared (uploads) and pick arbitrary destinations for
-  # Incoming / Temp / completed-files dirs (downloads). Restricting to
-  # xdg-download alone makes the most common config — "share my Music
-  # folder, save downloads to ~/Movies" — silently fail. This matches
-  # qBittorrent / Transmission on Flathub for the same reason.
-  - --filesystem=home
+  # Specific filesystem access
+  # This will allow the default use case without changing any settings
+  # Users can change the download directory to the aMule directory in their downloads folder.
+  # Using permission managers or manual editing, users can allow access to more directories
+  - --filesystem=~/.aMule:create
+  - --filesystem=xdg-download/aMule:create
+  - --filesystem=xdg-music:ro
   - --talk-name=org.freedesktop.PowerManagement.Inhibit
   - --talk-name=org.kde.StatusNotifierWatcher
   - --talk-name=com.canonical.AppMenu.Registrar