programs: feedbackd: sandbox w/ bwrap

2024-02-16 03:49:59 +00:00
parent 48d96c1f36
commit 2b66ffc58a
1 changed files with 5 additions and 0 deletions
--- a/hosts/common/programs/feedbackd.nix
+++ b/hosts/common/programs/feedbackd.nix
@@ -24,6 +24,11 @@ in
      default = {};
    };

+    sandbox.method = "bwrap";
+    sandbox.wrapperType = "wrappedDerivation";
+    sandbox.whitelistDbus = [ "user" ];
+    sandbox.whitelistAudio = true;
+
    # N.B.: feedbackd will load ~/.config/feedbackd/themes/default.json by default
    # - but using that would forbid `parent-theme = "default"`
    # the default theme ships support for these events: