Ranomier/NixToSee
Ranomier/NixToSee
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

initial commit

Browse source
This commit is contained in:
Ranomier 2024-09-21 17:10:45 +02:00 • committed by Ranomier
commit 2597fc7fb8
27 changed files with 1051 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

63
modules/sec_auth/firejail.nix Normal file
View file

@ -0,0 +1,63 @@
# TODO refine firejail it seems that / is not shielded enough and app armor does not work
{ pkgs, ... }:
{
programs.firejail = {
enable = true;
wrappedBinaries = {
firefox = {
executable = "${pkgs.firefox}/bin/firefox";
profile = "${pkgs.firejail}/etc/firejail/firefox.profile";
extraArgs = [
# Required for U2F USB stick
"--ignore=private-dev"
# Enforce dark mode
"--env=GTK_THEME=Adwaita:dark"
# Enable system notifications
"--dbus-user.talk=org.freedesktop.Notifications"
# For screen sharing
"--dbus-user.talk=org.freedesktop.portal.*"
];
};
element-desktop = {
executable = "${pkgs.element-desktop}/bin/element-desktop";
profile = "${pkgs.firejail}/etc/firejail/element-desktop.profile";
extraArgs = [
# Required for U2F USB stick
"--ignore=private-dev"
# Enforce dark mode
"--env=GTK_THEME=Adwaita:dark"
# Enable system notifications
"--dbus-user.talk=org.freedesktop.Notifications"
# For screen sharing
"--dbus-user.talk=org.freedesktop.portal.*"
];
};
brave = {
executable = "${pkgs.brave}/bin/brave";
profile = "${pkgs.firejail}/etc/firejail/brave.profile";
extraArgs = [
# Required for U2F USB stick
"--ignore=private-dev"
# Enforce dark mode
"--env=GTK_THEME=Adwaita:dark"
# Enable system notifications
"--dbus-user.talk=org.freedesktop.Notifications"
# For screen sharing
"--dbus-user.talk=org.freedesktop.portal.*"
];
};
};
};
environment.etc = {
"firejail/brave.local".text = ''
whitelist ''${HOME}/.config/brave
whitelist ''${HOME}/.local
whitelist ''${HOME}/Downloads
'';
};
}