colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

programs: geary: fix sandboxing

Browse Source 
this is an UGLY one. geary itself uses bwrap, and that fails if it's sandboxed AT ALL in landlock (i.e. even with just / landlocked as RW).

maybe this has to do with what landlock-sandboxer considers 'read/write' to be, and there's actually more file ops i need to enable on /
This commit is contained in:
Colin 2024-01-27 11:28:08 +00:00
parent 3b4884fcf1
commit be06e61bfb
1 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
hosts/common/programs/geary.nix
View File

@ -19,7 +19,20 @@ in
};
};
sandbox.method = null; # "firejail"; #< TODO: it crashes when i try to load an inbox
sandbox.method = "bwrap";
sandbox.extraPaths = [
# geary sandboxes *itself* with bwrap, and dbus-proxy which, confusingly, causes it to *require* these paths.
# TODO: these could maybe be mounted empty. or maybe there's an env-var to disable geary's dbus-proxy.
"/sys/block"
"/sys/bus"
"/sys/class"
"/sys/dev"
"/sys/devices"
"/sys/fs"
];
# if sandbox.method == "landlock", then these dirs must exist in the sandbox, even if empty.
# fs.".config/geary".dir = {};
# fs.".local/share/folks".dir = {};
slowToBuild = true; # uses webkitgtk 4.1
persist.byStore.private = [