xdg-desktop-portal

xdg-desktop-portal
Name	xdg-desktop-portal
Developer	freedesktop.org contributors, Red Hat, GNOME Project, KDE
Released	2016
Programming language	C (programming language) and GLib
Operating system	Linux
License	GNU Lesser General Public License

xdg-desktop-portal is a desktop-agnostic service that provides a stable, sandbox-friendly portal API for sandboxed applications on Linux desktop environments. It mediates requests from sandboxed clients such as Flatpak, Snap, and AppImage runtimes to desktop-specific features provided by environments like GNOME Project, KDE, and Xfce. The project is hosted within the freedesktop.org ecosystem and is commonly used in conjunction with Wayland and X.Org Server sessions.

Overview

xdg-desktop-portal was created to reconcile modern application sandboxing initiatives such as Flatpak with traditional desktop integrations embodied by projects like GNOME Project and KDE. It implements a DBus-based broker that exposes a set of portals allowing sandboxed apps to access features such as file chooser, screenshot, notification, and clipboard in a controlled manner, bridging the gap between containerized runtimes and desktop shells like GNOME Shell and KWin. The design aligns with cross-project efforts on freedesktop.org to standardize interoperability among Wayland, X.Org Server, systemd, and distribution maintainers such as Fedora Project and Debian.

Architecture and Components

The architecture centers on a per-session portal service that runs in user space and communicates via D-Bus with sandboxed clients and backend implementations. Core components include the main portal daemon, a session bus owner tied to systemd --user, and backend modules that implement desktop-specific behavior for compositors like Mutter and KWin. Integration points also encompass Polkit for privilege delegation and PipeWire for multimedia streams such as screen capture. Tooling and libraries that interact with the portal include GLib, GObject, and higher-level bindings used by ecosystems like Flatpak runtimes and Freedesktop SDK.

Portals and APIs

Portals are defined interfaces offering functionality: file access via the FileChooser portal, screenshot and screen-cast via the Screenshot and ScreenCast portals, notifications via the Notification portal, secrets via the Secret Service portal, and device access via portals like the Power and Inhibitor APIs. These DBus interfaces are consumed by applications built with toolkits such as GTK and Qt and by runtimes managed by Flatpak and Snapcraft. The API design allows frontends to prompt the user through desktop-specific UI components provided by projects like GNOME Shell, KDE Plasma, and XFCE4 while keeping the client sandbox unchanged.

Desktop Backends and Implementations

Multiple backends implement the portal interfaces to provide native UI and policy behavior: the GNOME backend integrates with GNOME Shell and Mutter, the KDE backend integrates with KWin and Plasma, and lightweight desktop backends support environments such as Xfce and LXQt. Distributions including Fedora Project, Ubuntu, openSUSE, and Arch Linux package portal components and enable them via session management provided by systemd. Some third-party projects and commercial vendors integrate portal behavior into compositors such as Sway (window manager) and Weston.

Security and Permission Model

The security model relies on per-application sandbox isolation provided by runtimes like Flatpak or Snapcraft and on privileged mediation by the portal daemon. Authentication and authorization decisions can use Polkit policies or explicit user prompts driven by backend UI components from GNOME Project or KDE. For multimedia and screen capture, PipeWire is used to create minimal-access streams, reducing attack surface versus direct device access. The portal architecture minimizes privileged code in the sandbox, following principles advocated by projects like OpenBSD and security frameworks in Linux Foundation discussions.

Usage and Integration

Application authors and distribution maintainers integrate portal support to allow sandboxed apps to use desktop services without granting full host access. Toolkits like GTK and Qt provide helpers to call portal APIs, and runtimes such as Flatpak expose portal endpoints to contained apps. Desktop environments ensure user-consent UX is consistent by wiring portal prompts into shell components like GNOME Shell notifications or KDE Plasma dialogs. Enterprise distributions and independent projects such as elementary OS adopt portal workflows to balance usability and containment.

Development and History

Development began within the freedesktop.org community as a response to the rise of sandboxed application formats and the need for distribution-agnostic integration. Early collaborators included contributors from Red Hat and the GNOME Project, with subsequent adoption by KDE and community distributions such as Fedora Project and openSUSE. The project evolved alongside technologies like Flatpak, Wayland, and PipeWire and continues to be maintained by upstream contributors coordinated through freedesktop.org and upstream repositories. Notable milestones include integration with PipeWire for screen capture, adoption by major distributions, and cross-desktop backend implementations.

Category:Freedesktop.org Category:Linux desktop software Category:Sandboxing (computing)