Flatpak upgrade -y does not work

qtzvytqr77x4t5cq · March 2, 2026, 2:35am

I am having an issue with using the flatpak upgrade -y option in Virtualbox-Whonix Workstation sysmaint session.

flatpak upgrade -y
Warning: Failed to get revokefs-fuse socket from system-helper: Flatpak system operation GetRevokefsFd not allowed for user
Warning: Flatpak system operation Deploy not allowed for user
Warning: Failed to get revokefs-fuse socket from system-helper: Flatpak system operation GetRevokefsFd not allowed for user
Error: Flatpak system operation Deploy not allowed for user
Updates complete.
error: There were one or more errors
zsh: exit 1     flatpak upgrade -y

“flatpak upgrade” works normally.

I do not see documentation on this on http://www.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion/wiki/Sysmaint or http://www.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion/wiki/Install_Software#Flatpak . So I do not know if this restriction is intentional or not.

arraybolt3 · March 2, 2026, 4:15am

There are intentional restrictions modifying system-wide Flatpaks as a non-root user. The code that does this is here:

github.com/Kicksecure/security-misc

usr/share/polkit-1/actions/org.freedesktop.Flatpak.policy.security-misc%23security-misc-shared

master

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policyconfig PUBLIC "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN" "http://www.freedesktop.org/standards/PolicyKit/1.0/policyconfig.dtd">
<policyconfig>
  <!--
    Policy definitions for Flatpak system actions.
    Copyright (c) 2016 Alexander Larsson <alexl@redhat.com>

    Modified by Kicksecure.
    Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
    See the file COPYING for copying conditions.
  -->
  <vendor>The Flatpak Project</vendor>
  <vendor_url>https://github.com/flatpak/flatpak</vendor_url>
  <icon_name>package-x-generic</icon_name>
  <action id="org.freedesktop.Flatpak.app-install">
    <!-- SECURITY:
          - Normal users need admin authentication to install software
            system-wide.
          - Note that we install polkit rules that allow local users
            in the wheel group to install without authenticating.

This file has been truncated. show original

If you’re running flatpak in sysmaint mode to manage system-wide Flatpaks, it should be run using sudo (or otherwise run as root).

qtzvytqr77x4t5cq · March 2, 2026, 2:29pm

I run “flatpak upgrade” without root just fine in the sysmaint workstation. There is a popup that quickly shows up, but before I can see it, it disappears. So it is news to me that I have to run flatpak update as root in the workstation.

[workstation sysmaint ~]% flatpak upgrade
Looking for updates...

Nothing to do.

I have tried running it in the user workstation before, but it does not work.
(off-topic but might be interesting to note- I can update python packages via pipx in the user workstation and am not limited to the sysmaint workstation for that)

Patrick · March 2, 2026, 4:03pm

Polkit, which flatpak is using, is functional in sysmaint sysmaint and will permit it for account sysmaint, which is a member of Linux user group sudo.

arraybolt3 · March 3, 2026, 1:15am

Hmm, I assumed polkit wouldn’t let flatpak be used as non-root under sysmaint because of the errors the user was getting. I probably should have read the code more carefully before replying. Maybe when not using -y, flatpak uses polkit APIs that may require authentication, and those pass, but when using -y, flatpak tries to use non-interactive APIs, and those fail? (This is pure speculation)