-
Bug
-
Resolution: Unresolved
-
Minor
-
None
-
rhel-9.5
-
No
-
None
-
rhel-sst-java
-
None
-
False
-
False
-
-
None
-
None
-
None
-
None
-
None
What were you trying to do that didn't work?
[RFE] From RHEL 7.9 up through the current RHEL 9, if any non-headless (i.e. GUI) openjdk is installed, not only is all the X11 dependencies installed, but so is `flatpak`. If you install other select GUI packages, `flatpak` is brought in.
Customer states that `flatpak` should never be an installation dependency, even for the X11/GUI experience.
What is the impact of this issue to you?
When `flatpak` is installed on a Server (which always happens when installing openjdk), any user with a bash or sftp capability can install (sideload) and run any non-privileged GUI application by leveraging its USB Export per
https://docs.flatpak.org/en/latest/usb-drives.html
It will live in their homedir with all necessary dependencies, along with its data.
Please provide the package NVR for which the bug is seen:
1. `java-1.8.0-openjdk`
How reproducible is this bug?:
Everytime.
Steps to reproduce
- # Install java-openjdk
- Along with all other dependencies 'Flatpak' is also installed.
Expected results
By default, weak dependencies should never be installed
flatpak should be explicitly installed – not even defined as a weak-dependency. Nothing ever has flatpak as a mandatory dependency for its operation (like shared libs are.)
Actual results
Flatpak is getting pulled and installed as a dependency for java-openjdk installs.