foodogsquared/nixos-config
1
0
Fork 0
mirror of https://github.com/foo-dogsquared/nixos-config.git synced 2025-01-31 04:58:01 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

wrapper-manager/sandboxing/bubblewrap: refactor and update

Browse Source
This commit is contained in:
Gabriel Arazas 2024-07-29 19:04:45 +08:00
parent 5376666247
commit 0d32b27571
No known key found for this signature in database
GPG Key ID: 62104B43D00AA360
3 changed files with 13 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
modules/wrapper-manager/sandboxing/bubblewrap/dbus-filter.nix
View File

@ -108,7 +108,7 @@ in
};
};
config.dbus.filter.extraArgs =
config.extraArgs =
let
makePolicyArgs = dbusName: policyMetadata:
lib.optionals (policyMetadata.level != null) [ "--${policyMetadata.level}=${dbusName}" ]

4
modules/wrapper-manager/sandboxing/bubblewrap/default.nix
View File

@ -97,6 +97,10 @@ in
# In case isolation is also enabled, we'll have this still
# enabled at least.
sandboxing.bubblewrap.extraArgs = lib.mkAfter [ "--share-net" ];
# The most common network-related files found on most
# distributions. This should be enough in most cases. If not,
# we'll probably let the launcher handle this.
sandboxing.bubblewrap.binds.ro = [
"/etc/ssh"
"/etc/hosts"

13
modules/wrapper-manager/sandboxing/bubblewrap/filesystem.nix
View File

@ -162,18 +162,19 @@ let
'';
};
};
in
{
options.sandboxing.bubblewrap = bubblewrapModuleFactory { isGlobal = true; };
# TODO: There has to be a better way to get this info without relying on
# pkgs.closureInfo builder, right?
config.sandboxing.bubblewrap.binds.ro =
getClosurePaths = rootpaths:
let
sharedNixPathsClosureInfo = pkgs.closureInfo { rootpaths = cfg.sharedNixPaths; };
sharedNixPathsClosureInfo = pkgs.closureInfo { inherit rootpaths; };
closurePaths = lib.readFile "${sharedNixPathsClosureInfo}/store-paths";
in
lib.lists.filter (p: p != "") (lib.splitStrings "\n" closurePaths);
in
{
options.sandboxing.bubblewrap = bubblewrapModuleFactory { isGlobal = true; };
config.sandboxing.bubblewrap.binds.ro = getClosurePaths cfg.sharedNixPaths;
config.sandboxing.bubblewrap.filesystem =
let
@ -195,6 +196,8 @@ in
config = lib.mkIf (config.sandboxing.variant == "bubblewrap") (lib.mkMerge [
{
sandboxing.bubblewrap.binds.ro = getClosurePaths submoduleCfg.sharedNixPaths;
sandboxing.bubblewrap.filesystem =
let
makeFilesystemMapping = operation: bind: