colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

seatd: ACTUALLY sandbox with bunpen

Browse Source
This commit is contained in:
Colin
2024-09-07 18:24:33 +00:00
parent fc72884c2e
commit 9b8bdfaf5e
1 changed files with 5 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
hosts/common/programs/seatd.nix
View File

@@ -13,9 +13,8 @@ lib.mkMerge [
"-Ddefaultpath=${seatdSock}" "-Ddefaultpath=${seatdSock}"
]; ];
}); });
sandbox.method = "bwrap"; sandbox.method = "bunpen";
sandbox.capabilities = [ sandbox.capabilities = [
# "chown"
"dac_override" #< TODO: is there no way to get rid of this? (use the `tty` group?) "dac_override" #< TODO: is there no way to get rid of this? (use the `tty` group?)
# "sys_admin" # "sys_admin"
"sys_tty_config" "sys_tty_config"
@@ -58,18 +57,18 @@ lib.mkMerge [
restartIfChanged = false; restartIfChanged = false;
serviceConfig.Type = "simple"; serviceConfig.Type = "simple";
serviceConfig.ExecStart = "${cfg.package}/bin/seatd -g seat"; serviceConfig.ExecStart = "${cfg.package}/bin/seatd -g seat --bunpen-debug=4";
serviceConfig.Group = "seat"; serviceConfig.Group = "seat";
# serviceConfig.AmbientCapabilities = [ # serviceConfig.AmbientCapabilities = [
# # "CAP_DAC_OVERRIDE" # "CAP_DAC_OVERRIDE"
# "CAP_NET_ADMIN" # "CAP_NET_ADMIN"
# "CAP_SYS_ADMIN" # "CAP_SYS_ADMIN"
# # "CAP_SYS_TTY_CONFIG" # "CAP_SYS_TTY_CONFIG"
# ]; # ];
serviceConfig.CapabilityBoundingSet = [ serviceConfig.CapabilityBoundingSet = [
# "CAP_CHOWN"
"CAP_DAC_OVERRIDE" #< needed, to access /dev/tty "CAP_DAC_OVERRIDE" #< needed, to access /dev/tty
"CAP_NET_ADMIN" #< needed by bwrap/bunpen to unshare net namespace (undocumented requirement?) "CAP_NET_ADMIN" #< needed by bwrap/bunpen to unshare net namespace (undocumented requirement?)
"CAP_SETPCAP" #< TODO: this is a limitation of bunpen, which wants to add caps from bounding to inheritable, and drop from ambient
"CAP_SYS_ADMIN" #< needed by bwrap/bunpen "CAP_SYS_ADMIN" #< needed by bwrap/bunpen
"CAP_SYS_TTY_CONFIG" "CAP_SYS_TTY_CONFIG"
]; ];