Everyday use
Privacy and permissions
What apps, helpers and plugins can ask for, which questions WolOS asks you, and where to take a permission back.
On this page
What it is
A map of every place WolOS asks before it acts or remembers what an app was allowed to do: the Privacy & Security pane in Settings, the confirmation sheets that appear on screen, the first-use malware check, the approval sheet for helpers, and the permissions of shell plugins. The technical reference is on Security and Assistants and automation; this page is for the person at the keyboard.
Why
A permission you never see is not consent. WolOS puts the question on your screen, names who is asking, and lets you take the answer back. Where it can only advise (it cannot stop an app that ignores a setting) it says so instead of showing a switch that promises more than it does.
How
Settings > Privacy & Security
- App Connections. Apps you allow are listed with what each can do, in plain sentences: show notifications, keep this computer from sleeping, keep its own preferences, ask you to choose a file, read the text you copied (when it asks), replace what you copied, change the volume and mute, see the volume and what is playing, see whether the computer is online (never where), see the battery level, see the names of connected devices, send messages to apps you allow, search apps and settings, read your account name, type and click as if it were you, install or remove apps and packages, install apps built on this computer that nobody at WolOS reviewed. Reset gives an app back what it asked for when installed. With no grants, the pane says so.
- Screen Recording is not a per-app switch. Apps ask each time they share your screen, and you choose which screen or window. Only WolOS's own screenshot and recording tools can copy the screen without asking.
- Security. The firewall (blocks connections from other computers that you did not start), disk encryption state, system protections, the malware check.
- Startup Security shows how this computer starts and finishes a waiting Secure Boot setup (Secure Boot).
Some permissions are enforced by the system and some are advisory: Settings says which. An advisory grant is recorded and shown to helpers that ask, but an app that ignores it is not stopped. For example, the camera, microphone and location permissions are advisory today, and so are files outside your home; X11 apps share one trust domain per account.
Who is asking: the identity of an app
Apps talk to the system service through a socket. Since 0.12 each app is identified the moment it connects, from what the kernel says (never from what the app claims), and both sides confirm each other with a handshake before any request. A program can no longer borrow another program's permissions (ADR 0033). One account can no longer slow down another's apps or use up sockets for everyone.
Sheets that ask you
| When | What you see |
|---|---|
| A package changes (install, remove, update) | A sheet naming what will change. Nothing happens until you confirm, and every change made as root asks. |
| A package file or one built on this computer is installed, the system is rolled back or the update channel is switched | The administrator password. The package file is copied to a root-only folder first, so the file you saw is the file that installs (ADR 0034). |
| Accounts, remote login, firewall, permissions, boot environments | The administrator password every time, even right after you typed it. |
| A helper wants to change something | Deny, Always Allow, Allow Once; focus starts on Deny so a stray key never says yes. See Assistants and automation. |
| A web app is added or removed, a module turned on, a session saved or reopened by a helper | It asks every time. A reminder or notification shows its full text before you allow it. |
| The malware check stops a file | One notification, and a row in the pane with Move to Trash and a deliberate Open Anyway. |
A program running in your account can no longer answer these sheets for you.
Helpers and Always Allow
An assistant started with wol mcp is named on the sheet together with the program that started it, and an Always Allow holds only for that program. Review and revoke grants in Settings > Assistants & Automation, where they are kept per helper and per capability. The capabilities are: read, appearance, sound, display, network, focus, apps, notify, screen-capture, window-list, files, restore and modules. wol api --json lists every helper command and the capability it needs.
Plugins
A plugin declares what it needs in its manifest; you grant it with wol plugin enable or in the Store. Tiles, Dock items and shortcuts that run commands do so only after you allow it. A plugin's web requests cannot be redirected to another host, its notifications are rate limited, and an exec that is not a wol verb needs the run permission. See the Plugin API reference.
The first-use malware check
Downloads, removable disks, AppImages, .wol files, Windows programs and new programs are checked the first time they open, on this computer only. Nothing leaves it. Nothing appears when nothing is wrong. Full virus signatures are an opt-in switch (off by default; about 1 GB of memory while it runs). It reads each account's download folder safely and refuses a file it could not scan. New malware can get past it; the pane says what is covered. See Security.
Clipboard, history and records
Clipboard history (Shift+Super+V) can search, pin and clear, and never keeps one-time codes. Settings changes are recorded with who made them in Restore > Recent Changes. Error reports are off by default.
If something goes wrong
| What you see | What to do |
|---|---|
| An app lost a permission | Settings > Privacy & Security > App Connections > Reset gives it back what it asked for at install. |
| A helper keeps asking | That is the gate working: reads run, changes ask. Choose Always Allow for that helper and capability, or revoke it in Assistants & Automation. |
| "No WolOS session is showing" | A helper asked for approval while no desktop session was running; start one and ask again. |
| A sheet is not answered | An unanswered sheet times out and refuses (50 seconds), so nothing changes. |
| The malware check stopped a file you trust | Use Open Anyway in the pane, or wol security allow <path>. wol security scan <path> checks a file. |
| A permission is not enforced | Settings marks advisory permissions; WolOS cannot stop an app that ignores them. |