colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

blast-ugjka: sandbox with bunpen

Browse Source
This commit is contained in:
Colin
2024-09-06 03:52:36 +00:00
parent 31d475bf88
commit cc90183ca2
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
hosts/common/programs/blast-ugjka/default.nix
View File

@@ -24,7 +24,7 @@ let
in in
{ {
sane.programs.blast-ugjka = { sane.programs.blast-ugjka = {
sandbox.method = "bwrap"; sandbox.method = "bunpen";
sandbox.whitelistAudio = true; sandbox.whitelistAudio = true;
sandbox.net = "clearnet"; sandbox.net = "clearnet";
}; };
@@ -36,12 +36,13 @@ in
pkgs = [ "blast-ugjka" ]; pkgs = [ "blast-ugjka" ];
srcRoot = ./.; srcRoot = ./.;
}; };
sandbox.method = "bwrap"; sandbox.method = "bunpen";
sandbox.whitelistAudio = true; sandbox.whitelistAudio = true;
sandbox.net = "clearnet"; sandbox.net = "clearnet";
#v else it fails to reap its children (or, maybe, it fails to hook its parent's death signal?) #v else it fails to reap its children (or, maybe, it fails to hook its parent's death signal?)
#v might be possible to remove this, but kinda hard to see a clean way. #v might be possible to remove this, but kinda hard to see a clean way.
sandbox.isolatePids = false; sandbox.isolatePids = false;
sandbox.extraPaths = [ "/proc" ]; #< for isolatePids
suggestedPrograms = [ "blast-ugjka" "sane-die-with-parent" ]; suggestedPrograms = [ "blast-ugjka" "sane-die-with-parent" ];
}; };