eg25-control: sandbox

2024-07-06 03:06:58 +00:00
parent b062610866
commit f50b10682f
1 changed files with 11 additions and 0 deletions
--- a/hosts/common/programs/eg25-control.nix
+++ b/hosts/common/programs/eg25-control.nix
@@ -6,6 +6,17 @@ in
  sane.programs.eg25-control = {
    suggestedPrograms = [ "mmcli" ];

+    sandbox.method = "bwrap";
+    sandbox.extraPaths = [
+      "/sys/class/modem-power"
+      "/sys/devices"
+      # "/var/lib/eg25-control"
+    ];
+    sandbox.net = "all";  #< for downloading the almanac
+    sandbox.whitelistDbus = [
+      "system"  #< used by `mmcli`
+    ];
+
    services.eg25-control-powered = {
      description = "eg25-control-powered: power to the Qualcomm eg25 modem used by PinePhone";
      startCommand = "eg25-control --power-on --verbose";