colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

modules/programs: add a sane.strictSandboxing option

Browse Source
This commit is contained in:
Colin 2024-01-27 17:11:07 +00:00
parent 5ca208d07f
commit a7d081bfcb
1 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
modules/programs/default.nix
View File

@ -334,6 +334,10 @@ let
configs = lib.mapAttrsToList (name: p: {
assertions = [
{
assertion = !(p.sandbox.enable && p.sandbox.method == null) || !p.enabled || p.package == null || !config.sane.strictSandboxing;
message = "program ${name} specified no `sandbox.method`; please configure a method, or set sandbox.enable = false.";
}
{
assertion = (p.net == "clearnet") || p.sandbox.method != null;
message = ''program "${name}" requests net "${p.net}", which requires sandboxing, but sandboxing was disabled'';
@ -448,6 +452,13 @@ in
this is mostly an internal implementation detail.
'';
};
sane.strictSandboxing = mkOption {
type = types.bool;
default = false;
description = ''
whether to require that every `sane.program` explicitly specify its sandbox settings
'';
};
};
config =