Xfce Forum

xef

Member

Registered: 2023-08-21

Posts: 2

Untrusted application launcher problem (Debian 12.1 XFCE 4.18)

Hello. I've read a lot of replies on this theme, but haven't found an optimal solution.

I have a flash drive with Debian Live XFCE and dozens of applications + scripts that I have been collecting for several years. I use .desktop files (also on the flash drive) to run them quickly.

I had no problems with debian-live-11.7.0-amd64-xfce.iso (XFCE 4.16), but when I replaced it with debian-live-12.1.0-amd64-xfce.iso (XFCE 4.18) all .desktop started to require confirmation before launching "Untrusted application launcher The desktop file "***" is in as insecure location...".

If I click the "Make Executable", the desktop shortcut starts to work, but since the distribution is Live, the changes are not saved and I have to do it all over again the next time I boot.

As I understand it, "Make Executable" just adds the "xfce-exe-checksum" attribute, which is stored in the GVFS (virtual file subsystem).

I wanted to create a script like that, when run, would add this attribute to all .desktop files on the flash

for f in ~/media/user/FLASH_DRIVE/apps/*.desktop; gio set -t string "$f" metadata::xfce-exe-checksum "$(sha256sum "$f" | awk '{print $1}')"; done

but as it turned out, there is no gio support in this Linux distribution and it is not rational to install libglib2.0 every time.

Can anyone advise me on the best solution for my case? Excluding giving up the Live image/XFCE or rolling back to debian-live-11.7.0.

I have two thoughts:
1) Find a way to add "xfce-exe-checksum" attribute without gio, but by directly editing some GVFS file.
2) Find a way to add path /media/user/FLASH_DRIVE/apps/ to white list (found information in this thread that there are trusted directories where confirmation is not required)

ToZ

Administrator

From: Canada

Registered: 2011-06-02

Posts: 11,481

Re: Untrusted application launcher problem (Debian 12.1 XFCE 4.18)

Hello and welcome.

1) Find a way to add "xfce-exe-checksum" attribute without gio, but by directly editing some GVFS file.

This is going to be tough. You might want to open a bug report against thunar regarding this to see if the developer will consider an alternative if gio is not installed.

2) Find a way to add path /media/user/FLASH_DRIVE/apps/ to white list (found information in this thread that there are trusted directories where confirmation is not required)

You could try adding that path to your $XDG_DATA_DIRS. Something like:

XDG_DATA_DIRS=$XDG_DATA_DIRS:/media/user/FLASH_DRIVE/apps

...so that is allowed, but how will you do that on a live system? You'd need to set this during Xfce start, or at least before "Thunar --daemon" start.

Or alternatively, something like:

thunar -q
export XDG_DATA_DIRS=$XDG_DATA_DIRS:/media/user/FLASH_DRIVE/apps
Thunar --daemon &

...but that will only work while that Thunar --daemon process is running.

---

Please remember to mark your thread [SOLVED] to make it easier for others to find
--- How To Ask For Help | FAQ | Developer Wiki  |  Community | Contribute ---

xef

Member

Registered: 2023-08-21

Posts: 2

Re: Untrusted application launcher problem (Debian 12.1 XFCE 4.18)

Got it, thanks for the reply