Saving files to root directory not showing warning

Feedback
1

I have discovered a small 'issue' within ZorinOS 18.1 with GNOME 46.

When an app (flatpak or native) tries to save a file to the root directory (/...), it cannot, because it is running as the user and not root, however it 'saves' it there anyway, even though it didn't really save. The apps seem to think that it saved, as OnlyOffice continued to report the document as "saved" while editing it, however when re-opened, the file was gone (because it was never saved in the first place...). The user cannot save to the root directory as it is generally drwxrwxr-x and owned by root:root. Hence, only root (sudo) can write to that directory.
When in the CLI, trying to "touch /doc.docx" will throw a "Permission Denied" error, and can only be done via "sudo".

There should be a warning implemented into the system to either send a small prompt on the screen to say the user cannot write there and make them choose another folder, or it should simply prompt for a password (to elevate to sudo) and allow the save to happen there. However, the latter is less preferable as you would then need to import your password each time you save the document (or anything else).

This issue is not only applicable to OnlyOffice though. The same thing happens in Brave Browser, it allows the user to save a PDF of a page (and other things) to / and believes that it did save, but no file was written, and no prompt was given.

I am aware this isn't a critical error nor bug, and it isn't at all best practice to save personal documents in root, however it can be problematic as ZorinOS with GNOME (I assume) is seen as a more beginner friendly Linux distro, and some people may not be aware to not save things into root, or may have accidentally clicked into it, and simply assume it's ok to save there. A simple popup on the screen could eliminate the future accidents.

SYSTEM INFO:
ZorinOS 18.1 Core
Kernel 7.0.0-31-generic
GNOME 46.0
WM Mutter
This was in a VM with all updates installed, but the issue was discovered on an old HP ProDesk, also with all updates installed.
Brave Browser in this case was the 'native' version (at /usr/bin/brave-browser-stable) and OnlyOffice was a flatpak.

4 Likes
2

yeah ive hit that too. app says saved, file never existed, because the write to / failed and the app didnt check the return code.

flatpaks are even worse about this since theyre sandboxed. onlyoffice writing to / without a real error dialog is a classic fail-open bug.

workaround for me is just never pick / as a save target. use ~/Documents or a real folder you own. if you want the OS to yell, thats more of a gtk/portal thing than zorin specifically, probably worth a bug report upstream for onlyoffice ignoring EACCES.

1 Like
3

Yeah I wouldn't personally ever select root as a save location, but I've noticed some family members that aren't as tech savvy, accidentally selecting it, not realising and just pressing save.
I might report a bug to gtk upstream, I'm not sure if it's worth an OnlyOffice bug report, as it isn't their fault, and it isn't only in their app.

1 Like
5

Developers who write things, should, make it a point to consider whether their software requires root access to install. Not all of them do. I have noticed that myself, and have noticed installs that failed as a result. I hear you. I get the message. Getting developers to hear it is the greater issue. Have you tried to talk to a vendor about it? I have not. I just gave up and moved on to something better. (rolling eyes).

1 Like
6

I haven't spoken to any vendors yet, but it seems to be the only way to get this resolved so I might try find someone to speak to about it.