colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

wike: sandbox with bwrap

Browse Source
This commit is contained in:
Colin
2024-01-27 12:29:58 +00:00
parent a6b824d3c4
commit 0a25ef544f
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
hosts/common/programs/wike.nix
View File

@@ -1,6 +1,16 @@
{ ... }: { ... }:
{ {
sane.programs.wike = { sane.programs.wike = {
sandbox.method = "bwrap";
sandbox.extraPaths = [
# wike sandboxes *itself* with bwrap, and dbus-proxy which, confusingly, causes it to *require* these paths.
# TODO: these could maybe be mounted empty.
"/sys/block"
"/sys/bus"
"/sys/class"
"/sys/dev"
"/sys/devices"
];
# wike probably meant to put everything here in a subdir, but didn't. # wike probably meant to put everything here in a subdir, but didn't.
persist.byStore.cryptClearOnBoot = [ persist.byStore.cryptClearOnBoot = [
".cache/webkitgtk" ".cache/webkitgtk"