From f959a0dd0061697a64ef7fdd61fc496e82e961a7 Mon Sep 17 00:00:00 2001
From: Colin <colin@uninsane.org>
Date: Tue, 3 Sep 2024 12:41:12 +0000
Subject: [PATCH] sane-open: sandbox with bunpen

---
 hosts/common/programs/sane-open.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hosts/common/programs/sane-open.nix b/hosts/common/programs/sane-open.nix
index d31ffe71d..ac03f6354 100644
--- a/hosts/common/programs/sane-open.nix
+++ b/hosts/common/programs/sane-open.nix
@@ -1,7 +1,7 @@
 { ... }:
 {
   sane.programs.sane-open = {
-    sandbox.method = "bwrap";
+    sandbox.method = "bunpen";
     sandbox.autodetectCliPaths = "existing";  # for when opening a file
     sandbox.whitelistDbus = [ "user" ];
     sandbox.isolatePids = false;  #< to toggle keyboard
@@ -9,6 +9,7 @@
       ".local/share/applications"
     ];
     sandbox.extraRuntimePaths = [ "sway" ];  #< calls `swaymsg` to query rotation and see if there's room for a keyboard
+    sandbox.extraPaths = [ "/proc" ];  #< to be able to launch bwrap programs
     suggestedPrograms = [
       "gdbus"
       "xdg-utils"