From 5c4058d5ac7e7944973ca8216c258fc50c194e22 Mon Sep 17 00:00:00 2001
From: Ophestra <cat@gensokyo.uk>
Date: Tue, 25 Mar 2025 01:52:49 +0900
Subject: app: run in native sandbox

Signed-off-by: Ophestra <cat@gensokyo.uk>
---
 nixos.nix | 21 +++++++++------------
 1 file changed, 9 insertions(+), 12 deletions(-)

(limited to 'nixos.nix')

diff --git a/nixos.nix b/nixos.nix
index 37ef5563..2c5b5db9 100644
--- a/nixos.nix
+++ b/nixos.nix
@@ -86,12 +86,11 @@ in
                   enablements = with app.capability; (if wayland then 1 else 0) + (if x11 then 2 else 0) + (if dbus then 4 else 0) + (if pulse then 8 else 0);
                   conf = {
                     inherit (app) id;
-                    command = [
-                      (pkgs.writeScript "${app.name}-start" ''
-                        #!${pkgs.zsh}${pkgs.zsh.shellPath}
-                        ${script}
-                      '')
-                    ];
+                    path = pkgs.writeScript "${app.name}-start" ''
+                      #!${pkgs.zsh}${pkgs.zsh.shellPath}
+                      ${script}
+                    '';
+                    args = [ "${app.name}-start" ];
                     confinement = {
                       app_id = aid;
                       inherit (app) groups;
@@ -99,17 +98,15 @@ in
                       home = getsubhome fid aid;
                       sandbox = {
                         inherit (app)
+                          devel
                           userns
                           net
                           dev
+                          tty
+                          multiarch
                           env
                           ;
-                        syscall = {
-                          inherit (app) compat multiarch bluetooth;
-                          deny_devel = !app.devel;
-                        };
                         map_real_uid = app.mapRealUid;
-                        no_new_session = app.tty;
                         direct_wayland = app.insecureWayland;
                         filesystem =
                           let
@@ -149,7 +146,7 @@ in
                           ]
                           ++ app.extraPaths;
                         auto_etc = true;
-                        override = [ "/var/run/nscd" ];
+                        cover = [ "/var/run/nscd" ];
                       };
                       inherit enablements;
                       inherit (dbusConfig) session_bus system_bus;
-- 
cgit v1.3.1