From 5a0760a5716c98cb339bb64812823b9f592233c4 Mon Sep 17 00:00:00 2001
From: Colin <colin@uninsane.org>
Date: Wed, 21 Feb 2024 00:02:40 +0000
Subject: [PATCH] programs: sandbox oathtools

---
 hosts/common/programs/assorted.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hosts/common/programs/assorted.nix b/hosts/common/programs/assorted.nix
index 085c7c35..fedc4ea0 100644
--- a/hosts/common/programs/assorted.nix
+++ b/hosts/common/programs/assorted.nix
@@ -693,6 +693,10 @@ in
     ];
     nvme-cli.sandbox.capabilities = [ "sys_rawio" ];
 
+    # contains only `oathtool`, which i only use for evaluating TOTP codes from CLI/stdin
+    oath-toolkit.sandbox.method = "bwrap";
+    oath-toolkit.sandbox.wrapperType = "wrappedDerivation";
+
     # settings (electron app)
     obsidian.persist.byStore.plaintext = [ ".config/obsidian" ];