colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

wpa_supplicant: sandbox

Browse Source
This commit is contained in:
Colin 2024-05-28 13:34:35 +00:00
parent be38d56717
commit e8846b2d6b
1 changed files with 45 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
hosts/common/programs/wpa_supplicant.nix
View File

@ -1,10 +1,50 @@
{ config, lib, ... }:
{ config, lib, pkgs, ... }:
let
cfg = config.sane.programs.wpa_supplicant;
in
{
sane.programs.wpa_supplicant = {};
services.udev.packages = lib.mkIf cfg.enabled [ cfg.package ];
# need to be on systemd.packages so we get its service file
systemd.packages = lib.mkIf cfg.enabled [ cfg.package ];
config = lib.mkMerge [
{
sane.programs.wpa_supplicant = {
packageUnwrapped = pkgs.wpa_supplicant.overrideAttrs (upstream: {
# nixpkgs wpa_supplicant generates a dbus file which has a path like
# /nix/store/abc-wpa_supplicant/nix/store/abc-wpa_supplicant/sbin/...
# upstreaming status: <https://github.com/NixOS/nixpkgs/pull/315346>
postInstall = upstream.postInstall + ''
substituteInPlace $out/share/dbus-1/system-services/* --replace-fail \
"$out$out" "$out"
'';
});
sandbox.method = "landlock"; #< 'bwrap' (likely) can't work, because it needs to manipulate net interfaces in the root namespace
sandbox.capabilities = [
# see also: <https://github.com/NixOS/nixpkgs/pull/305722>
"net_admin" "net_raw"
];
sandbox.extraPaths = [
"/dev/net"
"/dev/rfkill"
"/proc/sys/net"
"/sys/class/net"
"/sys/devices"
];
sandbox.whitelistDbus = [ "system" ];
};
}
(lib.mkIf cfg.enabled {
services.udev.packages = [ cfg.package ];
systemd.packages = [ cfg.package ]; #< needs to be on systemd.packages so we get its service file
systemd.services.wpa_supplicant.path = [ "/run/current-system/sw" ]; #< so it can find `sanebox`
# systemd.services.wpa_supplicant = {
# aliases = [ "dbus-fi.w1.wpa_supplicant1.service" ];
# before = [ "network.target" ];
# wantedBy = [ "network.target" ];
# serviceConfig = {
# Type = "dbus";
# BusName = "fi.w1.wpa_supplicant1";
# ExecStart = "${cfg.package}/bin/wpa_supplicant -u";
# Restart = "always";
# };
# };
})
];
}