colin/nix-files
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

programs: sandbox lsof with capsh only

Browse Source 
can't get it to sandbox any more aggressively with either landlock or
bwrap
This commit is contained in:
Colin 2024-02-16 04:53:18 +00:00
parent 28aaeb051f
commit 5f3ec42f57
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
hosts/common/programs/assorted.nix
View File

@ -443,6 +443,9 @@ in
losslesscut-bin.sandbox.whitelistWayland = true;
losslesscut-bin.sandbox.whitelistX = true;
lsof.sandbox.method = "capshonly"; # lsof doesn't sandbox under bwrap or even landlock w/ full access to /
lsof.sandbox.wrapperType = "wrappedDerivation";
"mate.engrampa".sandbox.method = "bwrap"; # TODO:sandbox: untested
"mate.engrampa".sandbox.wrapperType = "inplace";
"mate.engrampa".sandbox.whitelistWayland = true;