mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-01-11 22:30:25 +01:00
feat: add sandboxed wechat (#196)
This commit is contained in:
Ryan Yin
@@ -81,4 +81,3 @@ provide a much higher level of security.
|
||||
- https://git.grimmauld.de/Grimmauld/grimm-nixos-laptop/src/branch/main/hardening
|
||||
- Others:
|
||||
- Directly via `buildFHSUserEnvBubblewrap`:
|
||||
https://github.com/xddxdd/nur-packages/blob/master/pkgs/uncategorized/wechat-uos/default.nix
|
||||
|
||||
9
hardening/bwraps/default.nix
Normal file
9
hardening/bwraps/default.nix
Normal file
@@ -0,0 +1,9 @@
|
||||
{
|
||||
nixpkgs.overlays = [
|
||||
(_: super: {
|
||||
bwraps = {
|
||||
wechat = super.callPackage ./wechat.nix {};
|
||||
};
|
||||
})
|
||||
];
|
||||
}
|
||||
78
hardening/bwraps/wechat.nix
Normal file
78
hardening/bwraps/wechat.nix
Normal file
@@ -0,0 +1,78 @@
|
||||
# - wechat's flatpak manifest: https://github.com/flathub/com.tencent.WeChat/blob/master/com.tencent.WeChat.yaml
|
||||
# Refer:
|
||||
# - Flatpak manifest's docs:
|
||||
# - https://docs.flatpak.org/en/latest/manifests.html
|
||||
# - https://docs.flatpak.org/en/latest/sandbox-permissions.html
|
||||
#
|
||||
# TODO Since appimageTools.wrapAppImage do not support overriding, I have to pack this package myself.
|
||||
# https://github.com/NixOS/nixpkgs/pull/358977
|
||||
{
|
||||
appimageTools,
|
||||
fetchurl,
|
||||
}: let
|
||||
pname = "wechat";
|
||||
# https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/by-name/we/wechat/package.nix
|
||||
version = "4.0.1.11";
|
||||
src = fetchurl {
|
||||
url = "https://web.archive.org/web/20250512110825if_/https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_x86_64.AppImage";
|
||||
hash = "sha256-gBWcNQ1o1AZfNsmu1Vi1Kilqv3YbR+wqOod4XYAeVKo=";
|
||||
};
|
||||
# https://github.com/NixOS/nixpkgs/blob/master/pkgs/by-name/we/wechat/linux.nix
|
||||
appimageContents = appimageTools.extract {
|
||||
inherit pname version src;
|
||||
postExtract = ''
|
||||
patchelf --replace-needed libtiff.so.5 libtiff.so $out/opt/wechat/wechat
|
||||
'';
|
||||
};
|
||||
in
|
||||
appimageTools.wrapAppImage {
|
||||
inherit pname version;
|
||||
|
||||
src = appimageContents;
|
||||
|
||||
extraInstallCommands = ''
|
||||
mkdir -p $out/share/applications
|
||||
cp ${appimageContents}/wechat.desktop $out/share/applications/
|
||||
mkdir -p $out/share/pixmaps
|
||||
cp ${appimageContents}/wechat.png $out/share/pixmaps/
|
||||
|
||||
substituteInPlace $out/share/applications/wechat.desktop --replace-fail AppRun wechat
|
||||
'';
|
||||
|
||||
# Add these root paths to FHS sandbox to prevent WeChat from accessing them by default
|
||||
# Adapted from https://aur.archlinux.org/cgit/aur.git/tree/wechat-universal.sh?h=wechat-universal-bwrap
|
||||
extraPreBwrapCmds = ''
|
||||
XDG_DOCUMENTS_DIR="''${XDG_DOCUMENTS_DIR:-$(xdg-user-dir DOCUMENTS)}"
|
||||
if [[ -z "''${XDG_DOCUMENTS_DIR}" ]]; then
|
||||
echo 'Error: Failed to get XDG_DOCUMENTS_DIR, refuse to continue'
|
||||
exit 1
|
||||
fi
|
||||
|
||||
WECHAT_DATA_DIR="''${XDG_DOCUMENTS_DIR}/WeChat_Data"
|
||||
|
||||
# Using ''${WECHAT_DATA_DIR} as Wechat Data folder
|
||||
WECHAT_HOME_DIR="''${WECHAT_DATA_DIR}/home"
|
||||
WECHAT_FILES_DIR="''${WECHAT_DATA_DIR}/xwechat_files"
|
||||
|
||||
mkdir -p "''${WECHAT_FILES_DIR}"
|
||||
mkdir -p "''${WECHAT_HOME_DIR}"
|
||||
ln -snf "''${WECHAT_FILES_DIR}" "''${WECHAT_HOME_DIR}/xwechat_files"
|
||||
'';
|
||||
extraBwrapArgs = [
|
||||
"--tmpfs /home"
|
||||
"--tmpfs /root"
|
||||
# format: --bind <host-path> <sandbox-path>
|
||||
"--bind \${WECHAT_HOME_DIR} \${HOME}"
|
||||
"--bind \${WECHAT_FILES_DIR} \${WECHAT_FILES_DIR}"
|
||||
"--chdir \${HOME}"
|
||||
"--setenv QT_QPA_PLATFORM wayland"
|
||||
"--setenv QT_AUTO_SCREEN_SCALE_FACTOR 1"
|
||||
];
|
||||
chdirToPwd = false;
|
||||
unshareNet = false;
|
||||
unshareIpc = true;
|
||||
unsharePid = true;
|
||||
unshareUts = true;
|
||||
unshareCgroup = true;
|
||||
privateTmp = true;
|
||||
}
|
||||
@@ -22,8 +22,8 @@ in {
|
||||
qq = wrapper super ./qq.nix;
|
||||
qq-desktop-item = super.callPackage ./qq-desktop-item.nix {};
|
||||
|
||||
wechat-uos = wrapper super ./wechat-uos.nix;
|
||||
wechat-uos-desktop-item = super.callPackage ./wechat-uos-desktop-item.nix {};
|
||||
wechat = wrapper super ./wechat.nix;
|
||||
wechat-desktop-item = super.callPackage ./wechat-desktop-item.nix {};
|
||||
|
||||
firefox = wrapper super ./firefox.nix;
|
||||
firefox-desktop-item = super.callPackage ./firefox-desktop-item.nix {};
|
||||
|
||||
@@ -60,7 +60,6 @@ mkNixPak {
|
||||
sloth.xdgVideosDir
|
||||
];
|
||||
bind.ro = [
|
||||
# To actually make Firefox run
|
||||
"/sys/bus/pci"
|
||||
["${config.app.package}/lib/firefox" "/app/etc/firefox"]
|
||||
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
makeDesktopItem {
|
||||
name = "qq";
|
||||
desktopName = "QQ";
|
||||
exec = "qq %U";
|
||||
exec = "${qq}/bin/qq %U";
|
||||
terminal = false;
|
||||
# To find the icon name(nushell):
|
||||
# let p = NIXPKGS_ALLOW_UNFREE=1 nix eval --impure nixpkgs#qq.outPath | str trim --char '"'
|
||||
|
||||
@@ -1,17 +0,0 @@
|
||||
{
|
||||
makeDesktopItem,
|
||||
wechat-uos,
|
||||
}:
|
||||
makeDesktopItem {
|
||||
name = "wechat";
|
||||
desktopName = "WeChat";
|
||||
exec = "wechat-uos %U";
|
||||
terminal = false;
|
||||
# To find the icon name(nushell):
|
||||
# let p = NIXPKGS_ALLOW_UNFREE=1 nix eval --impure nixpkgs#wechat-uos.outPath | str trim --char '"'
|
||||
# tree $"($p)/share/icons"
|
||||
icon = "${wechat-uos}/share/icons/hicolor/256x256/apps/com.tencent.wechat.png";
|
||||
type = "Application";
|
||||
categories = ["Network"];
|
||||
comment = "Wechat boxed";
|
||||
}
|
||||
@@ -1,69 +0,0 @@
|
||||
# TODO: wechat-uos is running in FHS sandbox by default, it's problematic
|
||||
# to wrap it again via flatpak. We need to find a way to fix it.
|
||||
# https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/by-name/we/wechat-uos/package.nix
|
||||
# Refer:
|
||||
# - Flatpak manifest's docs:
|
||||
# - https://docs.flatpak.org/en/latest/manifests.html
|
||||
# - https://docs.flatpak.org/en/latest/sandbox-permissions.html
|
||||
# - wechat-uos's flatpak manifest: https://github.com/flathub/com.tencent.WeChat/blob/master/com.tencent.WeChat.yaml
|
||||
{
|
||||
lib,
|
||||
pkgs,
|
||||
mkNixPak,
|
||||
...
|
||||
}:
|
||||
mkNixPak {
|
||||
config = {sloth, ...}: {
|
||||
app = {
|
||||
package = pkgs.wechat-uos;
|
||||
binPath = "bin/wechat-uos";
|
||||
};
|
||||
flatpak.appId = "com.tencent.WeChat";
|
||||
|
||||
imports = [
|
||||
./modules/gui-base.nix
|
||||
./modules/network.nix
|
||||
];
|
||||
|
||||
# list all dbus services:
|
||||
# ls -al /run/current-system/sw/share/dbus-1/services/
|
||||
# ls -al /etc/profiles/per-user/ryan/share/dbus-1/services/
|
||||
dbus.policies = {
|
||||
"org.gnome.Shell.Screencast" = "talk";
|
||||
# System tray icon
|
||||
"org.freedesktop.Notifications" = "talk";
|
||||
"org.kde.StatusNotifierWatcher" = "talk";
|
||||
# File Manager
|
||||
"org.freedesktop.FileManager1" = "talk";
|
||||
# Uses legacy StatusNotifier implementation
|
||||
"org.kde.*" = "own";
|
||||
};
|
||||
bubblewrap = {
|
||||
# To trace all the home files QQ accesses, you can use the following nushell command:
|
||||
# just trace-access wechat-uos
|
||||
# See the Justfile in the root of this repository for more information.
|
||||
bind.rw = [
|
||||
# given the read write permission to the following directories.
|
||||
# NOTE: sloth.mkdir is used to create the directory if it does not exist!
|
||||
(sloth.mkdir (sloth.concat [sloth.homeDir "/.xwechat"]))
|
||||
|
||||
sloth.xdgDocumentsDir
|
||||
sloth.xdgDownloadDir
|
||||
sloth.xdgMusicDir
|
||||
sloth.xdgVideosDir
|
||||
];
|
||||
sockets = {
|
||||
x11 = false;
|
||||
wayland = true;
|
||||
pipewire = true;
|
||||
};
|
||||
|
||||
env = {
|
||||
# Hidpi scale
|
||||
"QT_AUTO_SCREEN_SCALE_FACTOR" = "1";
|
||||
# Only supports xcb
|
||||
"QT_QPA_PLATFORM" = "kcb";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -21,7 +21,7 @@
|
||||
pkgs.nixpaks.qq
|
||||
pkgs.nixpaks.qq-desktop-item
|
||||
# qqmusic
|
||||
# wechat-uos
|
||||
pkgs.bwraps.wechat
|
||||
];
|
||||
|
||||
# allow fontconfig to discover fonts and configurations installed through home.packages
|
||||
|
||||
@@ -232,7 +232,6 @@ in {
|
||||
# Instant Messaging
|
||||
# ======================================
|
||||
".config/QQ"
|
||||
".xwechat"
|
||||
|
||||
".local/share/TelegramDesktop"
|
||||
|
||||
|
||||
@@ -22,7 +22,7 @@
|
||||
# nixos hardening
|
||||
# "hardening/profiles/default.nix"
|
||||
"hardening/nixpaks"
|
||||
# "hardening/apparmor"
|
||||
"hardening/bwraps"
|
||||
];
|
||||
home-modules = map mylib.relativeToRoot [
|
||||
# common
|
||||
|
||||
Reference in New Issue
Block a user