programs: sane-sudo-redirect: disable sandbox

hosts/common/programs/sane-scripts.nix

@@ -128,6 +128,9 @@ in
       extraPaths = [ "/nix/var/nix" ];
     };
 
+    # if `tee` isn't trustworthy we have bigger problems
+    "sane-scripts.sudo-redirect".sandbox.enable = false;
+
     "sane-scripts.which".sandbox = {
       method = "bwrap";
       wrapperType = "wrappedDerivation";

pkgs/additional/sane-scripts/src/sane-sudo-redirect

@@ -14,4 +14,4 @@
 # $ sudo do_thing | sane-sudo-redirect /into/file
 # ```
 
-exec sudo tee $@ > /dev/null
+exec sudo tee "$@" > /dev/null