colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

ssh: fix sandboxing to support "tailscale ssh"

Browse Source
This commit is contained in:
Colin
2025-06-06 08:17:54 +00:00
parent 01438ff7bb
commit aeeed83b8b
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
hosts/common/programs/ssh.nix
View File

@@ -7,6 +7,9 @@ in
packageUnwrapped = pkgs.linkBinIntoOwnPackage pkgs.openssh "ssh"; packageUnwrapped = pkgs.linkBinIntoOwnPackage pkgs.openssh "ssh";
sandbox.net = "all"; sandbox.net = "all";
sandbox.whitelistSsh = true; sandbox.whitelistSsh = true;
# sandbox.autodetectCliPaths = "existingFile"; # to support `-o 'UserKnownHostsFile /path/...'`
sandbox.extraPaths = [ "/var/run/tailscale" ]; # `tailscale ssh` invokes ssh in a way that somehow calls _back_ into ts, not clear how.
sandbox.extraHomePaths = [ ".config/tailscale/ssh_known_hosts" ];
suggestedPrograms = [ "ssh-agent" ]; suggestedPrograms = [ "ssh-agent" ];
}; };