colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

sanebox: tighter dependency handling, to not rely on @BACKEND_FALLBACK@

Browse Source
This commit is contained in:
Colin 2024-05-25 10:26:36 +00:00
parent b035d312aa
commit 73f5c9608e
3 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
hosts/common/programs/assorted.nix
View File

@ -622,6 +622,7 @@ in
libcamera = {};
libcap.sandbox.enable = false; #< for `capsh`, which i use as a sandboxer
libcap_ng.sandbox.enable = false; # there's something about /proc/$pid/fd which breaks `readlink`/stat with every sandbox technique (except capsh-only)
libnotify.sandbox.method = "bwrap";

2
hosts/common/programs/sanebox.nix
View File

@ -18,6 +18,8 @@ in
sane.programs.sanebox = {
packageUnwrapped = pkgs.sanebox.override {
bubblewrap = cfg.bubblewrap.package;
passt = cfg.passt.package;
libcap = cfg.libcap.package;
landlock-sandboxer = pkgs.landlock-sandboxer.override {
# not strictly necessary (landlock ABI is versioned), however when sandboxer version != kernel version,
# the sandboxer may nag about one or the other wanting to be updated.

2
modules/programs/default.nix
View File

@ -437,7 +437,7 @@ let
] ++ lib.optionals (config.sandbox.method == "pastaonly") [
"passt"
] ++ lib.optionals (config.sandbox.method == "capshonly") [
"libcap_ng"
"libcap"
];
# declare a fs dependency for each secret, but don't specify how to populate it yet.
# can't populate it here because it varies per-user.