swaync-fbcli: sandbox (experimental)

hosts/common/programs/swaynotificationcenter/default.nix

@@ -45,6 +45,12 @@ in
         "util-linux"
       ];
     };
+    sandbox.method = "bwrap";
+    sandbox.whitelistDbus = [ "user" ];
+    sandbox.extraConfig = [
+      # `swaync-fbcli stop` needs to be able to find the corresponding `swaync-fbcli start` process
+      "--sanebox-keep-namespace" "pid"
+    ];
   };
 
   sane.programs.swaynotificationcenter = {