From 5c4058d5ac7e7944973ca8216c258fc50c194e22 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Tue, 25 Mar 2025 01:52:49 +0900 Subject: app: run in native sandbox Signed-off-by: Ophestra --- options.nix | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) (limited to 'options.nix') diff --git a/options.nix b/options.nix index d9ccfb7a..9e367732 100644 --- a/options.nix +++ b/options.nix @@ -148,21 +148,19 @@ in ''; }; - nix = mkEnableOption "nix daemon"; - userns = mkEnableOption "user namespace"; - mapRealUid = mkEnableOption "mapping to priv-user uid"; - dev = mkEnableOption "access to all devices"; + devel = mkEnableOption "debugging-related kernel interfaces"; + userns = mkEnableOption "user namespace creation"; tty = mkEnableOption "access to the controlling terminal"; - insecureWayland = mkEnableOption "direct access to the Wayland socket"; + multiarch = mkEnableOption "multiarch kernel-level support"; net = mkEnableOption "network access" // { default = true; }; - compat = mkEnableOption "disable syscall filter extensions"; - devel = mkEnableOption "development kernel APIs"; - multiarch = mkEnableOption "multiarch kernel support"; - bluetooth = mkEnableOption "AF_BLUETOOTH socket operations"; + nix = mkEnableOption "nix daemon access"; + mapRealUid = mkEnableOption "mapping to priv-user uid"; + dev = mkEnableOption "access to all devices"; + insecureWayland = mkEnableOption "direct access to the Wayland socket"; gpu = mkOption { type = nullOr bool; -- cgit v1.3.1