programs: sandbox more apps with wrapperType=wrappedDerivation

hosts/common/programs/animatch.nix

@@ -30,6 +30,7 @@
       });
     };
     sandbox.method = "bwrap";
+    sandbox.wrapperType = "wrappedDerivation";
     persist.byStore.plaintext = [
       # ".config/Holy Pangolin/Animatch"  #< used for SuperDerpy config (e.g. debug, disableTouch, fullscreen, enable sound, etc). SuperDerpy.ini
       ".local/share/Holy Pangolin/Animatch"  #< used for game state (level clears). SuperDerpy.ini

hosts/common/programs/dialect.nix

@@ -2,6 +2,7 @@
 {
   sane.programs.dialect = {
     sandbox.method = "bwrap";
+    sandbox.wrapperType = "inplace";  # share/search_providers/ calls back into the binary, weird wrap semantics
     sandbox.extraHomePaths = [
       ".config/dconf"  # to persist settings
     ];

hosts/common/programs/dino.nix

@@ -46,6 +46,7 @@ in
     };
 
     sandbox.method = "bwrap";
+    sandbox.wrapperType = "wrappedDerivation";
 
     persist.byStore.private = [ ".local/share/dino" ];
 

hosts/common/programs/element-desktop.nix

@@ -8,6 +8,7 @@
 {
   sane.programs.element-desktop = {
     sandbox.method = "bwrap";
+    sandbox.wrapperType = "wrappedDerivation";
     packageUnwrapped = pkgs.element-desktop.override {
       # use pre-build electron because otherwise it takes 4 hrs to build from source.
       electron = pkgs.electron-bin;

hosts/common/programs/epiphany.nix

@@ -9,6 +9,7 @@
 {
   sane.programs.epiphany = {
     sandbox.method = "bwrap";
+    sandbox.wrapperType = "inplace";  # /share/epiphany/default-bookmarks.rdf refers back to /share; dbus files to /libexec
     sandbox.extraConfig = [
       # default sandboxing breaks rendering in weird ways. sites are super zoomed in / not scaled.
       # enabling DRM (as below) seems to fix that.

hosts/common/programs/fractal.nix

@@ -28,6 +28,7 @@ in
     # packageUnwrapped = pkgs.fractal-next;
 
     sandbox.method = "bwrap";
+    sandbox.wrapperType = "wrappedDerivation";
 
     configOption = with lib; mkOption {
       default = {};

hosts/common/programs/g4music.nix

@@ -9,6 +9,7 @@
 {
   sane.programs.g4music = {
     sandbox.method = "bwrap";
+    sandbox.wrapperType = "wrappedDerivation";
     sandbox.extraHomePaths = [
       "Music"
     ];

hosts/common/programs/geary.nix

@@ -20,6 +20,7 @@ in
     };
 
     sandbox.method = "bwrap";
+    sandbox.wrapperType = "wrappedDerivation";
     sandbox.extraPaths = [
       # geary sandboxes *itself* with bwrap, and dbus-proxy which, confusingly, causes it to *require* these paths.
       # TODO: these could maybe be mounted empty. or maybe there's an env-var to disable geary's dbus-proxy.

hosts/common/programs/go2tv.nix

@@ -34,6 +34,7 @@ in
 {
   sane.programs.go2tv = {
     sandbox.method = "bwrap";
+    sandbox.wrapperType = "wrappedDerivation";
     sandbox.autodetectCliPaths = true;
     # for GUI invocation, allow the common media directories
     sandbox.extraHomePaths = [

hosts/common/programs/imagemagick.nix

@@ -2,6 +2,7 @@
 {
   sane.programs.imagemagick = {
     sandbox.method = "bwrap";
+    sandbox.wrapperType = "wrappedDerivation";
     sandbox.whitelistPwd = true;
     sandbox.autodetectCliPaths = true;  #< arg formatting is complicated enough that this won't always work.
     packageUnwrapped = pkgs.imagemagick.override {

hosts/common/programs/neovim.nix

@@ -87,6 +87,7 @@ in
 {
   sane.programs.neovim = {
     sandbox.method = "bwrap";
+    sandbox.wrapperType = "wrappedDerivation";
     sandbox.autodetectCliPaths = true;
     # sandbox.whitelistPwd = true;
     sandbox.extraHomePaths = [

hosts/common/programs/signal-desktop.nix

@@ -23,6 +23,7 @@ in
 
     packageUnwrapped = pkgs.signal-desktop-from-src;
     sandbox.method = "bwrap";
+    sandbox.wrapperType = "wrappedDerivation";
 
     # creds, media
     persist.byStore.private = [

hosts/common/programs/spot.nix

@@ -2,6 +2,7 @@
 {
   sane.programs.spot = {
     sandbox.method = "bwrap";
+    sandbox.wrapperType = "wrappedDerivation";
     secrets.".cache/spot/librespot/credentials/credentials.json" = ../../../secrets/common/spot_credentials.json.bin;
     persist.byStore.plaintext = [
       ".cache/spot/img"  # album art

hosts/common/programs/spotify.nix

@@ -2,6 +2,7 @@
 {
   sane.programs.spotify = {
     sandbox.method = "bwrap";
+    sandbox.wrapperType = "inplace";  # nontraditional package structure, where binaries live in /share/spotify
     sandbox.extraConfig = [
       "--sane-sandbox-firejail-arg"
       "--keep-dev-shm"

hosts/common/programs/tor-browser.nix

@@ -8,6 +8,7 @@
     #   useHardenedMalloc = false;
     # };
     sandbox.method = "bwrap";
+    sandbox.wrapperType = "wrappedDerivation";
     persist.byStore.cryptClearOnBoot = [
       ".local/share/tor-browser"
     ];

hosts/common/programs/tuba.nix

@@ -2,6 +2,7 @@
 {
   sane.programs.tuba = {
     sandbox.method = "bwrap";
+    sandbox.wrapperType = "wrappedDerivation";
     suggestedPrograms = [ "gnome-keyring" ];
   };
 }

hosts/common/programs/vlc.nix

@@ -11,6 +11,7 @@ in
 {
   sane.programs.vlc = {
     sandbox.method = "bwrap";
+    sandbox.wrapperType = "wrappedDerivation";
     sandbox.autodetectCliPaths = true;
     persist.byStore.private = [
       # vlc remembers play position in ~/.config/vlc/vlc-qt-interface.conf

hosts/common/programs/wike.nix

@@ -2,6 +2,7 @@
 {
   sane.programs.wike = {
     sandbox.method = "bwrap";
+    sandbox.wrapperType = "inplace";  # share/wike/wike-sp refers back to the binaries and share
     sandbox.extraPaths = [
       # wike sandboxes *itself* with bwrap, and dbus-proxy which, confusingly, causes it to *require* these paths.
       # TODO: these could maybe be mounted empty.