colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

programs: sane-private-change-passwd: sandbox

Browse Source 
note that this is entirely untested
This commit is contained in:
Colin 2024-02-25 16:35:13 +00:00
parent 5b647a1a90
commit 036145e6ba
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
hosts/common/programs/sane-scripts.nix
View File

@ -121,6 +121,16 @@ in
net = "all";
};
"sane-scripts.private-change-passwd".sandbox = {
method = "bwrap";
wrapperType = "wrappedDerivation";
autodetectCliPaths = "existing"; #< for the new `private` location
capabilities = [ "sys_admin" ]; # it needs to mount the new store
extraHomePaths = [
".persist/private"
];
};
"sane-scripts.private-do".sandbox = {
# because `mount` is a cap_sys_admin syscall, there's no great way to mount stuff dynamically like this.
# instead, we put ourselves in a mount namespace, do the mount, and drop into a shell or run a command.