sed: sandbox

hosts/common/programs/assorted.nix

@@ -477,7 +477,11 @@ in
       ".persist/plaintext"
     ];
 
-    gnused = {};
+    # sed: there is an edgecase of `--file=<foo>`, wherein `foo` won't be whitelisted.
+    gnused.sandbox.method = "bwrap";
+    gnused.sandbox.autodetectCliPaths = "existingFile";
+    gnused.sandbox.whitelistPwd = true;  #< `-i` flag creates a temporary file in pwd (?) and then moves it.
+
     gpsd = {};
 
     gptfdisk.sandbox.method = "landlock";