system/desktop
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

sandboxing

Browse source
This commit is contained in:
root 2026-07-18 11:45:31 -03:00
parent 5f70e8be94
commit 0f1a81c2aa
No known key found for this signature in database
13 changed files with 230 additions and 90 deletions
Download patch file Download diff file Expand all files Collapse all files

14
home/user.nix
View file

@ -62,13 +62,16 @@
systemd.user.services.waypipe-socket = {
Unit = {
Description = "start waypipe client";
After = [ "niri.service" ];
Requires = [ "niri.service" ];
};
Install = {
WantedBy = [ "graphical-session.target" ];
};
Service = {
ExecStart = "${pkgs.waypipe}/bin/waypipe --socket /tmp/waypipe.sock client";
ExecStartPost = "${pkgs.acl}/bin/setfacl -m u:agent:rw /tmp/waypipe.sock";
ExecStartPost = "${pkgs.acl}/bin/setfacl -m g:sandbox:rw /tmp/waypipe.sock";
ExecStopPost = "${pkgs.coreutils}/bin/rm /tmp/waypipe.sock";
RuntimeDirectory = "waypipe";
Type = "simple";
Restart = "on-failure";
@ -255,6 +258,7 @@
};
programs = {
opencode.enable = true;
dank-material-shell.enable = true;
ssh = {
enable = true;
@ -351,7 +355,7 @@
};
safe = {
directory = [
"/home/agent/*"
"/home/sandbox/*"
];
};
};
@ -360,9 +364,9 @@
home.packages = with pkgs; [
xrdb
(writeShellScriptBin "agent" ''
machinectl shell agent@ ${waypipe}/bin/waypipe --socket /run/waypipe.sock server fish
'')
# (writeShellScriptBin "agent" ''
# machinectl shell agent@ ${waypipe}/bin/waypipe --socket /run/waypipe.sock server fish
# '')
(writeShellApplication {
name = "tmux-sessionizer";
runtimeInputs = [