programs: sandboxing: link /etc into sandboxed programs

this is crucial for e.g. swaync, to find its resource files.
maybe a good idea to link *every* package directory which i also link
into /run/current-system.

modules/programs/make-sandboxed.nix

@@ -218,10 +218,15 @@ let
     sandboxedWithoutFixedRefs = (runCommand "${pkgName}-sandboxed-non-binary" {} ''
       set -e
       mkdir "$out"
-      if [ -e "${unsandboxed}/share" ]; then
-        mkdir "$out/share"
-        ${buildPackages.xorg.lndir}/bin/lndir "${unsandboxed}/share" "$out/share"
-      fi
+      # link in a limited subset of the directories.
+      # lib/ is the primary one to avoid, because of shared objects that would be unsandboxed if dlopen'd.
+      # all other directories are safe-ish, because they won't end up on PATH or LDPATH.
+      for dir in etc share; do
+        if [ -e "${unsandboxed}/$dir" ]; then
+          mkdir "$out/$dir"
+          ${buildPackages.xorg.lndir}/bin/lndir "${unsandboxed}/$dir" "$out/$dir"
+        fi
+      done
       runHook postInstall
     '').overrideAttrs (_: {
       # specifically for meta.priority, though it shouldn't actually matter here.