colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

programs: fix sandboxing errors for programs which create files (notably: ffmpeg)

Browse Source
This commit is contained in:
Colin
2024-02-03 00:17:54 +00:00
parent 3439ca34b8
commit 2f9fad503c
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
hosts/common/programs/assorted.nix
View File

@@ -255,7 +255,7 @@ in
ffmpeg.sandbox.method = "bwrap"; ffmpeg.sandbox.method = "bwrap";
ffmpeg.sandbox.wrapperType = "wrappedDerivation"; # slow to build ffmpeg.sandbox.wrapperType = "wrappedDerivation"; # slow to build
ffmpeg.sandbox.autodetectCliPaths = true; ffmpeg.sandbox.autodetectCliPaths = "existingFileOrParent"; # it outputs uncreated files -> parent dir needs mounting
file.sandbox.method = "bwrap"; file.sandbox.method = "bwrap";
file.sandbox.wrapperType = "wrappedDerivation"; file.sandbox.wrapperType = "wrappedDerivation";
@@ -303,7 +303,7 @@ in
nano.sandbox.method = "bwrap"; nano.sandbox.method = "bwrap";
nano.sandbox.wrapperType = "wrappedDerivation"; nano.sandbox.wrapperType = "wrappedDerivation";
nano.sandbox.autodetectCliPaths = true; nano.sandbox.autodetectCliPaths = "existingFileOrParent";
# settings (electron app) # settings (electron app)
obsidian.persist.byStore.plaintext = [ ".config/obsidian" ]; obsidian.persist.byStore.plaintext = [ ".config/obsidian" ];
@@ -314,7 +314,7 @@ in
rsync.sandbox.method = "bwrap"; # TODO:sandbox: untested rsync.sandbox.method = "bwrap"; # TODO:sandbox: untested
rsync.sandbox.wrapperType = "wrappedDerivation"; rsync.sandbox.wrapperType = "wrappedDerivation";
rsync.sandbox.autodetectCliPaths = true; rsync.sandbox.autodetectCliPaths = "existingFileOrParent";
sequoia.sandbox.method = "bwrap"; # TODO:sandbox: untested sequoia.sandbox.method = "bwrap"; # TODO:sandbox: untested
sequoia.sandbox.wrapperType = "wrappedDerivation"; # slow to build sequoia.sandbox.wrapperType = "wrappedDerivation"; # slow to build
@@ -351,7 +351,7 @@ in
tcpdump.sandbox.method = "landlock"; tcpdump.sandbox.method = "landlock";
tcpdump.sandbox.wrapperType = "wrappedDerivation"; tcpdump.sandbox.wrapperType = "wrappedDerivation";
tcpdump.sandbox.autodetectCliPaths = true; tcpdump.sandbox.autodetectCliPaths = "existingFileOrParent";
tcpdump.sandbox.capabilities = [ "net_admin" "net_raw" ]; tcpdump.sandbox.capabilities = [ "net_admin" "net_raw" ];
tree.sandbox.method = "landlock"; tree.sandbox.method = "landlock";
tree.sandbox.wrapperType = "wrappedDerivation"; tree.sandbox.wrapperType = "wrappedDerivation";
@@ -360,7 +360,7 @@ in
unzip.sandbox.method = "bwrap"; unzip.sandbox.method = "bwrap";
unzip.sandbox.wrapperType = "wrappedDerivation"; unzip.sandbox.wrapperType = "wrappedDerivation";
unzip.sandbox.autodetectCliPaths = true; unzip.sandbox.autodetectCliPaths = "existingFileOrParent";
unzip.sandbox.whitelistPwd = true; unzip.sandbox.whitelistPwd = true;
visidata.sandbox.method = "bwrap"; # TODO:sandbox: untested visidata.sandbox.method = "bwrap"; # TODO:sandbox: untested