colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

README: document the sandboxing feature of my "programs" module

Browse Source
This commit is contained in:
Colin
2024-02-14 05:24:48 +00:00
parent e599724811
commit 9faf1bb52c
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
README.md
View File

@@ -99,6 +99,11 @@ i.e. you might find value in using these in your own config:
- allows `fs` and `persist` config values to be gated behind program deployment: - allows `fs` and `persist` config values to be gated behind program deployment:
- e.g. `/home/<user>/.mozilla/firefox` is persisted only for users who - e.g. `/home/<user>/.mozilla/firefox` is persisted only for users who
`sane.programs.firefox.enableFor.user."<user>" = true;` `sane.programs.firefox.enableFor.user."<user>" = true;`
- allows aggressive sandboxing any program:
- `sane.programs.firefox.sandbox.method = "bwrap"; # sandbox with bubblewrap`
- `sane.programs.firefox.sandbox.whitelistWayland = true; # allow it to render a wayland window`
- `sane.programs.firefox.sandbox.extraHomePaths = [ "Downloads" ]; # allow it read/write access to ~/Downloads`
- integrated with `fs` and `persist` modules so that programs' config files and persisted data stores are linked into the sandbox w/o any extra involvement.
- `modules/users.nix` - `modules/users.nix`
- convenience layer atop the above modules so that you can just write - convenience layer atop the above modules so that you can just write
`fs.".config/git"` instead of `fs."/home/colin/.config/git"` `fs.".config/git"` instead of `fs."/home/colin/.config/git"`