swayidle: sandbox

hosts/common/programs/swayidle.nix

@@ -34,7 +34,11 @@ in
         };
       };
     };
-    # sandboxing: TODO
+
+    sandbox.method = "bwrap";
+    sandbox.whitelistDbus = [ "user" ];  #< might need system too, for inhibitors
+    sandbox.whitelistWayland = true;
+
     services.swayidle = {
       description = "swayidle: perform actions when sway session is idle";
       after = [ "graphical-session.target" ];