wpa_supplicant: sandbox
This commit is contained in:
parent
be38d56717
commit
e8846b2d6b
|
@ -1,10 +1,50 @@
|
||||||
{ config, lib, ... }:
|
{ config, lib, pkgs, ... }:
|
||||||
let
|
let
|
||||||
cfg = config.sane.programs.wpa_supplicant;
|
cfg = config.sane.programs.wpa_supplicant;
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
sane.programs.wpa_supplicant = {};
|
config = lib.mkMerge [
|
||||||
services.udev.packages = lib.mkIf cfg.enabled [ cfg.package ];
|
{
|
||||||
# need to be on systemd.packages so we get its service file
|
sane.programs.wpa_supplicant = {
|
||||||
systemd.packages = lib.mkIf cfg.enabled [ cfg.package ];
|
packageUnwrapped = pkgs.wpa_supplicant.overrideAttrs (upstream: {
|
||||||
|
# nixpkgs wpa_supplicant generates a dbus file which has a path like
|
||||||
|
# /nix/store/abc-wpa_supplicant/nix/store/abc-wpa_supplicant/sbin/...
|
||||||
|
# upstreaming status: <https://github.com/NixOS/nixpkgs/pull/315346>
|
||||||
|
postInstall = upstream.postInstall + ''
|
||||||
|
substituteInPlace $out/share/dbus-1/system-services/* --replace-fail \
|
||||||
|
"$out$out" "$out"
|
||||||
|
'';
|
||||||
|
});
|
||||||
|
sandbox.method = "landlock"; #< 'bwrap' (likely) can't work, because it needs to manipulate net interfaces in the root namespace
|
||||||
|
sandbox.capabilities = [
|
||||||
|
# see also: <https://github.com/NixOS/nixpkgs/pull/305722>
|
||||||
|
"net_admin" "net_raw"
|
||||||
|
];
|
||||||
|
sandbox.extraPaths = [
|
||||||
|
"/dev/net"
|
||||||
|
"/dev/rfkill"
|
||||||
|
"/proc/sys/net"
|
||||||
|
"/sys/class/net"
|
||||||
|
"/sys/devices"
|
||||||
|
];
|
||||||
|
sandbox.whitelistDbus = [ "system" ];
|
||||||
|
};
|
||||||
|
}
|
||||||
|
(lib.mkIf cfg.enabled {
|
||||||
|
services.udev.packages = [ cfg.package ];
|
||||||
|
systemd.packages = [ cfg.package ]; #< needs to be on systemd.packages so we get its service file
|
||||||
|
systemd.services.wpa_supplicant.path = [ "/run/current-system/sw" ]; #< so it can find `sanebox`
|
||||||
|
# systemd.services.wpa_supplicant = {
|
||||||
|
# aliases = [ "dbus-fi.w1.wpa_supplicant1.service" ];
|
||||||
|
# before = [ "network.target" ];
|
||||||
|
# wantedBy = [ "network.target" ];
|
||||||
|
# serviceConfig = {
|
||||||
|
# Type = "dbus";
|
||||||
|
# BusName = "fi.w1.wpa_supplicant1";
|
||||||
|
# ExecStart = "${cfg.package}/bin/wpa_supplicant -u";
|
||||||
|
# Restart = "always";
|
||||||
|
# };
|
||||||
|
# };
|
||||||
|
})
|
||||||
|
];
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue
Block a user