colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

modules/programs: sandboxing: add a "whitelistX" option

Browse Source
This commit is contained in:
Colin
2024-02-15 00:09:16 +00:00
parent 8ac4869f10
commit 5f1036118f
1 changed files with 14 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
modules/programs/default.nix
View File

@@ -283,14 +283,16 @@ let
sandbox.net = mkOption { sandbox.net = mkOption {
type = types.coercedTo type = types.coercedTo
types.str types.str
(s: if s == "clearnet" then "all" else s) (s: if s == "clearnet" || s == "localhost" then "all" else s)
(types.enum [ null "all" "vpn" ]); (types.enum [ null "all" "vpn" ]);
default = null; default = null;
description = '' description = ''
how this app should have its network traffic routed. how this app should have its network traffic routed.
- "all": unsandboxed network. - "all": unsandboxed network.
- "clearnet": traffic is routed only over clearnet. - "clearnet": traffic is routed only over clearnet.
currently, just an alias for "all" currently, just an alias for "all".
- "localhost": only needs access to other services running on this host.
currently, just an alias for "all".
- "vpn": to route all traffic over the default VPN. - "vpn": to route all traffic over the default VPN.
- null: to maximally isolate from the network. - null: to maximally isolate from the network.
''; '';
@@ -400,6 +402,14 @@ let
note that this does NOT permit access to compositor admin tooling like `swaymsg`. note that this does NOT permit access to compositor admin tooling like `swaymsg`.
''; '';
}; };
sandbox.whitelistX = mkOption {
type = types.bool;
default = false;
description = ''
allow the sandbox to communicate with the X server.
typically, this is actually the Xwayland server and you should also enable `whitelistWayland`.
'';
};
sandbox.extraPaths = mkOption { sandbox.extraPaths = mkOption {
type = types.listOf types.str; type = types.listOf types.str;
@@ -477,6 +487,8 @@ let
# this gets the symlink into the sandbox, but not the actual secret. # this gets the symlink into the sandbox, but not the actual secret.
fs = lib.mapAttrs (_homePath: _secretSrc: {}) config.secrets; fs = lib.mapAttrs (_homePath: _secretSrc: {}) config.secrets;
sandbox.net = lib.mkIf config.sandbox.whitelistX "localhost";
sandbox.extraPaths = lib.mkIf config.sandbox.whitelistDri [ sandbox.extraPaths = lib.mkIf config.sandbox.whitelistDri [
# /dev/dri/renderD128: requested by wayland-egl (e.g. KOreader, animatch, geary) # /dev/dri/renderD128: requested by wayland-egl (e.g. KOreader, animatch, geary)
# - but everything seems to gracefully fallback to *something* (MESA software rendering?) # - but everything seems to gracefully fallback to *something* (MESA software rendering?)