colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

programs: forkstat: sandbox

Browse Source
This commit is contained in:
Colin 2024-02-19 13:15:15 +00:00
parent da1053d635
commit 44647e0d36
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
hosts/common/programs/assorted.nix
View File

@ -401,6 +401,15 @@ in
withWebkit = false;
};
forkstat.sandbox.method = "landlock"; #< doesn't seem to support bwrap
forkstat.sandbox.wrapperType = "wrappedDerivation";
forkstat.sandbox.extraConfig = [
"--sane-sandbox-keep-pidspace"
];
forkstat.sandbox.extraPaths = [
"/proc"
];
# fuzzel: TODO: re-enable sandbox. i use fuzzel both as an entry system (snippets) AND an app-launcher.
# as an app-launcher, it cannot be sandboxed without over-restricting the app it launches.
# should probably make it not be an app-launcher