Click service does not perform any permission check on the passed path
Since click-service
simply pass the provided path to click
command while running as root, it enables the users to do this:
sudo chown root:root private.click
sudo chmod 400 private.click
gdbus call --system --dest com.lomiri.click --object-path /com/lomiri/click --method com.lomiri.click.Install $(pwd)/private.click
Despite the user not having the permission to read the file, the click service will happily install it. I think this is not great on security.