wike: sandbox with bwrap

2024-01-27 12:29:58 +00:00 · 2024-01-27 12:29:58 +00:00 · 0a25ef544f
commit 0a25ef544f
parent a6b824d3c4
1 changed files with 10 additions and 0 deletions
--- a/hosts/common/programs/wike.nix
+++ b/hosts/common/programs/wike.nix
@ -1,6 +1,16 @@
 { ... }:
 {
  sane.programs.wike = {
+    sandbox.method = "bwrap";
+    sandbox.extraPaths = [
+      # wike sandboxes *itself* with bwrap, and dbus-proxy which, confusingly, causes it to *require* these paths.
+      # TODO: these could maybe be mounted empty.
+      "/sys/block"
+      "/sys/bus"
+      "/sys/class"
+      "/sys/dev"
+      "/sys/devices"
+    ];
    # wike probably meant to put everything here in a subdir, but didn't.
    persist.byStore.cryptClearOnBoot = [
      ".cache/webkitgtk"