programs: xarchiver: sandbox

2024-02-18 06:24:07 +00:00
parent 9fde167e71
commit 81a6600f54
1 changed files with 17 additions and 3 deletions
--- a/hosts/common/programs/xarchiver.nix
+++ b/hosts/common/programs/xarchiver.nix
@@ -1,7 +1,21 @@
 { pkgs, ... }:
 {
-  sane.programs.xarchiver.packageUnwrapped = pkgs.xarchiver.override {
-    # unar doesn't cross compile well, so disable support for it
-    unar = null;
+  sane.programs.xarchiver = {
+    packageUnwrapped = pkgs.xarchiver.override {
+      # unar doesn't cross compile well, so disable support for it
+      unar = null;
+    };
+
+    sandbox.method = "bwrap";
+    sandbox.wrapperType = "wrappedDerivation";
+    sandbox.whitelistWayland = true;
+    sandbox.extraHomePaths = [
+      "archive"
+      "ref"
+      "tmp"
+      "use"
+    ];
+    # allow extracting an archive in the rare case it's outside the common directories
+    sandbox.autodetectCliPaths = "existing";
  };
 }