···

       
8
       
8
       
 
       
  wrappedBins = pkgs.runCommand "firejail-wrapped-binaries"

     

       
9
       
9
       
 
       
    { preferLocalBuild = true;

     

       
10
       
10
       
 
       
      allowSubstitutes = false;

     

       
11
       
11
       
+
       
      # take precedence over non-firejailed versions

     

       
12
       
12
       
+
       
      meta.priority = -1;

     

       
11
       
13
       
 
       
    }

     

       
12
       
14
       
 
       
    ''

     

       
13
       
15
       
 
       
      mkdir -p $out/bin

     

       
16
       
16
       
+
       
      mkdir -p $out/share/applications

     

       
14
       
17
       
 
       
      ${lib.concatStringsSep "\n" (lib.mapAttrsToList (command: value:

     

       
15
       
18
       
 
       
      let

     

       
16
       
19
       
 
       
        opts = if builtins.isAttrs value

     

       
17
       
20
       
 
       
        then value

     

       
18
       
18
       
-
       
        else { executable = value; profile = null; extraArgs = []; };

     

       
21
       
21
       
+
       
        else { executable = value; desktop = null; profile = null; extraArgs = []; };

     

       
19
       
22
       
 
       
        args = lib.escapeShellArgs (

     

       
20
       
23
       
 
       
          opts.extraArgs

     

       
21
       
24
       
 
       
          ++ (optional (opts.profile != null) "--profile=${toString opts.profile}")

     

       
22
       
22
       
-
       
          );

     

       
25
       
25
       
+
       
        );

     

       
23
       
26
       
 
       
      in

     

       
24
       
27
       
 
       
      ''

     

       
25
       
28
       
 
       
        cat <<_EOF >$out/bin/${command}

     
···

       
27
       
30
       
 
       
        exec /run/wrappers/bin/firejail ${args} -- ${toString opts.executable} "\$@"

     

       
28
       
31
       
 
       
        _EOF

     

       
29
       
32
       
 
       
        chmod 0755 $out/bin/${command}

     

       
33
       
33
       
+
       


     

       
34
       
34
       
+
       
        ${lib.optionalString (opts.desktop != null) ''

     

       
35
       
35
       
+
       
          substitute ${opts.desktop} $out/share/applications/$(basename ${opts.desktop}) \

     

       
36
       
36
       
+
       
            --replace ${opts.executable} $out/bin/${command}

     

       
37
       
37
       
+
       
        ''}

     

       
30
       
38
       
 
       
      '') cfg.wrappedBinaries)}

     

       
31
       
39
       
 
       
    '';

     

       
32
       
40
       
 
       


     
···

       
42
       
50
       
 
       
            description = lib.mdDoc "Executable to run sandboxed";

     

       
43
       
51
       
 
       
            example = literalExpression ''"''${lib.getBin pkgs.firefox}/bin/firefox"'';

     

       
44
       
52
       
 
       
          };

     

       
53
       
53
       
+
       
          desktop = mkOption {

     

       
54
       
54
       
+
       
            type = types.nullOr types.path;

     

       
55
       
55
       
+
       
            default = null;

     

       
56
       
56
       
+
       
            description = lib.mkDoc ".desktop file to modify. Only necessary if it uses the absolute path to the executable.";

     

       
57
       
57
       
+
       
            example = literalExpression ''"''${pkgs.firefox}/share/applications/firefox.desktop"'';

     

       
58
       
58
       
+
       
          };

     

       
45
       
59
       
 
       
          profile = mkOption {

     

       
46
       
60
       
 
       
            type = types.nullOr types.path;

     

       
47
       
61
       
 
       
            default = null;

     
···

       
71
       
85
       
 
       
      '';

     

       
72
       
86
       
 
       
      description = lib.mdDoc ''

     

       
73
       
87
       
 
       
        Wrap the binaries in firejail and place them in the global path.

     

       
74
       
74
       
-
       


     

       
75
       
75
       
-
       
        You will get file collisions if you put the actual application binary in

     

       
76
       
76
       
-
       
        the global environment (such as by adding the application package to

     

       
77
       
77
       
-
       
        `environment.systemPackages`), and applications started via

     

       
78
       
78
       
-
       
        .desktop files are not wrapped if they specify the absolute path to the

     

       
79
       
79
       
-
       
        binary.

     

       
80
       
88
       
 
       
      '';

     

       
81
       
89
       
 
       
    };

     

       
82
       
90
       
 
       
  };