foodogsquared/nixos-config
1
0
Fork 0
mirror of https://github.com/foo-dogsquared/nixos-config.git synced 2025-01-31 04:58:01 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

wrapper-manager/sandboxing/bubblewrap: refactor and update

Browse Source
This commit is contained in:
Gabriel Arazas 2024-07-29 19:04:45 +08:00
parent 5376666247
commit 0d32b27571
No known key found for this signature in database
GPG Key ID: 62104B43D00AA360
3 changed files with 13 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
modules/wrapper-manager/sandboxing/bubblewrap/dbus-filter.nix
View File

@ -108,7 +108,7 @@ in
}; };
}; };
config.dbus.filter.extraArgs = config.extraArgs =
let let
makePolicyArgs = dbusName: policyMetadata: makePolicyArgs = dbusName: policyMetadata:
lib.optionals (policyMetadata.level != null) [ "--${policyMetadata.level}=${dbusName}" ] lib.optionals (policyMetadata.level != null) [ "--${policyMetadata.level}=${dbusName}" ]

4
modules/wrapper-manager/sandboxing/bubblewrap/default.nix
View File

@ -97,6 +97,10 @@ in
# In case isolation is also enabled, we'll have this still # In case isolation is also enabled, we'll have this still
# enabled at least. # enabled at least.
sandboxing.bubblewrap.extraArgs = lib.mkAfter [ "--share-net" ]; sandboxing.bubblewrap.extraArgs = lib.mkAfter [ "--share-net" ];
# The most common network-related files found on most
# distributions. This should be enough in most cases. If not,
# we'll probably let the launcher handle this.
sandboxing.bubblewrap.binds.ro = [ sandboxing.bubblewrap.binds.ro = [
"/etc/ssh" "/etc/ssh"
"/etc/hosts" "/etc/hosts"

13
modules/wrapper-manager/sandboxing/bubblewrap/filesystem.nix
View File

@ -162,18 +162,19 @@ let
''; '';
}; };
}; };
in
{
options.sandboxing.bubblewrap = bubblewrapModuleFactory { isGlobal = true; };
# TODO: There has to be a better way to get this info without relying on # TODO: There has to be a better way to get this info without relying on
# pkgs.closureInfo builder, right? # pkgs.closureInfo builder, right?
config.sandboxing.bubblewrap.binds.ro = getClosurePaths = rootpaths:
let let
sharedNixPathsClosureInfo = pkgs.closureInfo { rootpaths = cfg.sharedNixPaths; }; sharedNixPathsClosureInfo = pkgs.closureInfo { inherit rootpaths; };
closurePaths = lib.readFile "${sharedNixPathsClosureInfo}/store-paths"; closurePaths = lib.readFile "${sharedNixPathsClosureInfo}/store-paths";
in in
lib.lists.filter (p: p != "") (lib.splitStrings "\n" closurePaths); lib.lists.filter (p: p != "") (lib.splitStrings "\n" closurePaths);
in
{
options.sandboxing.bubblewrap = bubblewrapModuleFactory { isGlobal = true; };
config.sandboxing.bubblewrap.binds.ro = getClosurePaths cfg.sharedNixPaths;
config.sandboxing.bubblewrap.filesystem = config.sandboxing.bubblewrap.filesystem =
let let
@ -195,6 +196,8 @@ in
config = lib.mkIf (config.sandboxing.variant == "bubblewrap") (lib.mkMerge [ config = lib.mkIf (config.sandboxing.variant == "bubblewrap") (lib.mkMerge [
{ {
sandboxing.bubblewrap.binds.ro = getClosurePaths submoduleCfg.sharedNixPaths;
sandboxing.bubblewrap.filesystem = sandboxing.bubblewrap.filesystem =
let let
makeFilesystemMapping = operation: bind: makeFilesystemMapping = operation: bind: