curl: sandbox

2024-07-16 07:23:32 +00:00
parent 40d32ec1d5
commit c72e66a901
3 changed files with 10 additions and 0 deletions
--- a/hosts/common/programs/assorted.nix
+++ b/hosts/common/programs/assorted.nix
@@ -39,6 +39,7 @@ in
      "btrfs-progs"
      "cacert.unbundled"  # some services require unbundled /etc/ssl/certs
      "cryptsetup"
+      "curl"
      "ddrescue"
      "dig"
      "dtc"  # device tree [de]compiler
--- a/hosts/common/programs/curl.nix
+++ b/hosts/common/programs/curl.nix
@@ -0,0 +1,8 @@
+{ ... }:
+{
+  sane.programs.curl = {
+    sandbox.method = "bwrap";
+    sandbox.net = "all";
+    sandbox.autodetectCliPaths = "parent";  #< for `-o` option
+  };
+}
--- a/hosts/common/programs/default.nix
+++ b/hosts/common/programs/default.nix
@@ -26,6 +26,7 @@
    ./conky
    ./cozy.nix
    ./cups.nix
+    ./curl.nix
    ./curlftpfs.nix
    ./dbus.nix
    ./dconf.nix