colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

programs: switch bridge-utils, btrfs-progs from landlock -> bwrap

Browse Source 
landlock can't isolate net yet, so bwrap gives better sandboxing
This commit is contained in:
Colin
2024-02-16 15:29:25 +00:00
parent af8a8358bd
commit 1b4306e649
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
hosts/common/programs/assorted.nix
View File

@@ -242,7 +242,7 @@ in
"/sys/devices" "/sys/devices"
]; ];
bridge-utils.sandbox.method = "landlock"; #< has to be in the same net namespace, at least. bridge-utils.sandbox.method = "bwrap"; #< bwrap, landlock: both work
bridge-utils.sandbox.wrapperType = "wrappedDerivation"; bridge-utils.sandbox.wrapperType = "wrappedDerivation";
bridge-utils.sandbox.net = "all"; bridge-utils.sandbox.net = "all";
@@ -255,7 +255,7 @@ in
]; ];
brightnessctl.sandbox.whitelistDbus = [ "system" ]; brightnessctl.sandbox.whitelistDbus = [ "system" ];
btrfs-progs.sandbox.method = "landlock"; btrfs-progs.sandbox.method = "bwrap"; #< bwrap, landlock: both work
btrfs-progs.sandbox.wrapperType = "wrappedDerivation"; btrfs-progs.sandbox.wrapperType = "wrappedDerivation";
btrfs-progs.sandbox.autodetectCliPaths = "existing"; # e.g. `btrfs filesystem df /my/fs` btrfs-progs.sandbox.autodetectCliPaths = "existing"; # e.g. `btrfs filesystem df /my/fs`
@@ -467,6 +467,12 @@ in
iftop.sandbox.wrapperType = "wrappedDerivation"; iftop.sandbox.wrapperType = "wrappedDerivation";
iftop.sandbox.capabilities = [ "net_raw" ]; iftop.sandbox.capabilities = [ "net_raw" ];
# inetutils: ping, ifconfig, hostname, traceroute, whois, ....
# TODO: requires more than this;
# - also, sandboxed `ping` doesn't make it onto /run/current-system/sw/bin; unsandboxed `ping` does instead
# inetutils.sandbox.method = "landlock"; # want to keep the same netns, at least.
# inetutils.sandbox.wrapperType = "wrappedDerivation";
iotop.sandbox.method = "landlock"; iotop.sandbox.method = "landlock";
iotop.sandbox.wrapperType = "wrappedDerivation"; iotop.sandbox.wrapperType = "wrappedDerivation";
iotop.sandbox.extraPaths = [ iotop.sandbox.extraPaths = [