pyrox.dev
1{ config, lib, pkgs, ... }:
2
3let
4 cfg = config.programs.firejail;
5
6 wrappedBins = pkgs.runCommand "firejail-wrapped-binaries"
7 { preferLocalBuild = true;
8 allowSubstitutes = false;
9 # take precedence over non-firejailed versions
10 meta.priority = -1;
11 }
12 ''
13 mkdir -p $out/bin
14 mkdir -p $out/share/applications
15 ${lib.concatStringsSep "\n" (lib.mapAttrsToList (command: value:
16 let
17 opts = if builtins.isAttrs value
18 then value
19 else { executable = value; desktop = null; profile = null; extraArgs = []; };
20 args = lib.escapeShellArgs (
21 opts.extraArgs
22 ++ (lib.optional (opts.profile != null) "--profile=${builtins.toString opts.profile}")
23 );
24 in
25 ''
26 cat <<_EOF >$out/bin/${command}
27 #! ${pkgs.runtimeShell} -e
28 exec /run/wrappers/bin/firejail ${args} -- ${builtins.toString opts.executable} "\$@"
29 _EOF
30 chmod 0755 $out/bin/${command}
31
32 ${lib.optionalString (opts.desktop != null) ''
33 substitute ${opts.desktop} $out/share/applications/$(basename ${opts.desktop}) \
34 --replace ${opts.executable} $out/bin/${command}
35 ''}
36 '') cfg.wrappedBinaries)}
37 '';
38
39in {
40 options.programs.firejail = {
41 enable = lib.mkEnableOption "firejail, a sandboxing tool for Linux";
42
43 wrappedBinaries = lib.mkOption {
44 type = lib.types.attrsOf (lib.types.either lib.types.path (lib.types.submodule {
45 options = {
46 executable = lib.mkOption {
47 type = lib.types.path;
48 description = "Executable to run sandboxed";
49 example = lib.literalExpression ''"''${lib.getBin pkgs.firefox}/bin/firefox"'';
50 };
51 desktop = lib.mkOption {
52 type = lib.types.nullOr lib.types.path;
53 default = null;
54 description = ".desktop file to modify. Only necessary if it uses the absolute path to the executable.";
55 example = lib.literalExpression ''"''${pkgs.firefox}/share/applications/firefox.desktop"'';
56 };
57 profile = lib.mkOption {
58 type = lib.types.nullOr lib.types.path;
59 default = null;
60 description = "Profile to use";
61 example = lib.literalExpression ''"''${pkgs.firejail}/etc/firejail/firefox.profile"'';
62 };
63 extraArgs = lib.mkOption {
64 type = lib.types.listOf lib.types.str;
65 default = [];
66 description = "Extra arguments to pass to firejail";
67 example = [ "--private=~/.firejail_home" ];
68 };
69 };
70 }));
71 default = {};
72 example = lib.literalExpression ''
73 {
74 firefox = {
75 executable = "''${lib.getBin pkgs.firefox}/bin/firefox";
76 profile = "''${pkgs.firejail}/etc/firejail/firefox.profile";
77 };
78 mpv = {
79 executable = "''${lib.getBin pkgs.mpv}/bin/mpv";
80 profile = "''${pkgs.firejail}/etc/firejail/mpv.profile";
81 };
82 }
83 '';
84 description = ''
85 Wrap the binaries in firejail and place them in the global path.
86 '';
87 };
88 };
89
90 config = lib.mkIf cfg.enable {
91 security.wrappers.firejail =
92 { setuid = true;
93 owner = "root";
94 group = "root";
95 source = "${lib.getBin pkgs.firejail}/bin/firejail";
96 };
97
98 environment.systemPackages = [ pkgs.firejail ] ++ [ wrappedBins ];
99 };
100
101 meta.maintainers = with lib.maintainers; [ peterhoeg ];
102}