programs: dissent: restrict dbus

2025-01-10 00:25:13 +00:00
parent 7ad1ca4e6b
commit 95839bfad8
1 changed files with 7 additions and 1 deletions
--- a/hosts/common/programs/dissent.nix
+++ b/hosts/common/programs/dissent.nix
@@ -38,8 +38,14 @@ in

    sandbox.net = "clearnet";
    sandbox.whitelistAudio = true;
-    sandbox.whitelistDbus.user = true;  #< TODO: reduce  # notifications
+    sandbox.whitelistDbus.user.call."org.freedesktop.secrets" = "*";  #< TODO: restrict secrets
+    sandbox.whitelistDbus.user.own = [ "so.libdb.dissent" ];
    sandbox.whitelistDri = true;
+    sandbox.whitelistPortal = [
+      "FileChooser"
+      "OpenURI"
+    ];
+    sandbox.whitelistSendNotifications = true;
    sandbox.whitelistWayland = true;
    sandbox.extraHomePaths = [
      "Music"