diff --git a/hardening/README.md b/hardening/README.md index f638a16d..9f2954b2 100644 --- a/hardening/README.md +++ b/hardening/README.md @@ -81,4 +81,3 @@ provide a much higher level of security. - https://git.grimmauld.de/Grimmauld/grimm-nixos-laptop/src/branch/main/hardening - Others: - Directly via `buildFHSUserEnvBubblewrap`: - https://github.com/xddxdd/nur-packages/blob/master/pkgs/uncategorized/wechat-uos/default.nix diff --git a/hardening/bwraps/default.nix b/hardening/bwraps/default.nix new file mode 100644 index 00000000..ac550174 --- /dev/null +++ b/hardening/bwraps/default.nix @@ -0,0 +1,9 @@ +{ + nixpkgs.overlays = [ + (_: super: { + bwraps = { + wechat = super.callPackage ./wechat.nix {}; + }; + }) + ]; +} diff --git a/hardening/bwraps/wechat.nix b/hardening/bwraps/wechat.nix new file mode 100644 index 00000000..c407e583 --- /dev/null +++ b/hardening/bwraps/wechat.nix @@ -0,0 +1,78 @@ +# - wechat's flatpak manifest: https://github.com/flathub/com.tencent.WeChat/blob/master/com.tencent.WeChat.yaml +# Refer: +# - Flatpak manifest's docs: +# - https://docs.flatpak.org/en/latest/manifests.html +# - https://docs.flatpak.org/en/latest/sandbox-permissions.html +# +# TODO Since appimageTools.wrapAppImage do not support overriding, I have to pack this package myself. +# https://github.com/NixOS/nixpkgs/pull/358977 +{ + appimageTools, + fetchurl, +}: let + pname = "wechat"; + # https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/by-name/we/wechat/package.nix + version = "4.0.1.11"; + src = fetchurl { + url = "https://web.archive.org/web/20250512110825if_/https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_x86_64.AppImage"; + hash = "sha256-gBWcNQ1o1AZfNsmu1Vi1Kilqv3YbR+wqOod4XYAeVKo="; + }; + # https://github.com/NixOS/nixpkgs/blob/master/pkgs/by-name/we/wechat/linux.nix + appimageContents = appimageTools.extract { + inherit pname version src; + postExtract = '' + patchelf --replace-needed libtiff.so.5 libtiff.so $out/opt/wechat/wechat + ''; + }; +in + appimageTools.wrapAppImage { + inherit pname version; + + src = appimageContents; + + extraInstallCommands = '' + mkdir -p $out/share/applications + cp ${appimageContents}/wechat.desktop $out/share/applications/ + mkdir -p $out/share/pixmaps + cp ${appimageContents}/wechat.png $out/share/pixmaps/ + + substituteInPlace $out/share/applications/wechat.desktop --replace-fail AppRun wechat + ''; + + # Add these root paths to FHS sandbox to prevent WeChat from accessing them by default + # Adapted from https://aur.archlinux.org/cgit/aur.git/tree/wechat-universal.sh?h=wechat-universal-bwrap + extraPreBwrapCmds = '' + XDG_DOCUMENTS_DIR="''${XDG_DOCUMENTS_DIR:-$(xdg-user-dir DOCUMENTS)}" + if [[ -z "''${XDG_DOCUMENTS_DIR}" ]]; then + echo 'Error: Failed to get XDG_DOCUMENTS_DIR, refuse to continue' + exit 1 + fi + + WECHAT_DATA_DIR="''${XDG_DOCUMENTS_DIR}/WeChat_Data" + + # Using ''${WECHAT_DATA_DIR} as Wechat Data folder + WECHAT_HOME_DIR="''${WECHAT_DATA_DIR}/home" + WECHAT_FILES_DIR="''${WECHAT_DATA_DIR}/xwechat_files" + + mkdir -p "''${WECHAT_FILES_DIR}" + mkdir -p "''${WECHAT_HOME_DIR}" + ln -snf "''${WECHAT_FILES_DIR}" "''${WECHAT_HOME_DIR}/xwechat_files" + ''; + extraBwrapArgs = [ + "--tmpfs /home" + "--tmpfs /root" + # format: --bind + "--bind \${WECHAT_HOME_DIR} \${HOME}" + "--bind \${WECHAT_FILES_DIR} \${WECHAT_FILES_DIR}" + "--chdir \${HOME}" + "--setenv QT_QPA_PLATFORM wayland" + "--setenv QT_AUTO_SCREEN_SCALE_FACTOR 1" + ]; + chdirToPwd = false; + unshareNet = false; + unshareIpc = true; + unsharePid = true; + unshareUts = true; + unshareCgroup = true; + privateTmp = true; + } diff --git a/hardening/nixpaks/default.nix b/hardening/nixpaks/default.nix index 09d7e483..f110fcd6 100644 --- a/hardening/nixpaks/default.nix +++ b/hardening/nixpaks/default.nix @@ -22,8 +22,8 @@ in { qq = wrapper super ./qq.nix; qq-desktop-item = super.callPackage ./qq-desktop-item.nix {}; - wechat-uos = wrapper super ./wechat-uos.nix; - wechat-uos-desktop-item = super.callPackage ./wechat-uos-desktop-item.nix {}; + wechat = wrapper super ./wechat.nix; + wechat-desktop-item = super.callPackage ./wechat-desktop-item.nix {}; firefox = wrapper super ./firefox.nix; firefox-desktop-item = super.callPackage ./firefox-desktop-item.nix {}; diff --git a/hardening/nixpaks/firefox.nix b/hardening/nixpaks/firefox.nix index c541ef74..7f064c2a 100644 --- a/hardening/nixpaks/firefox.nix +++ b/hardening/nixpaks/firefox.nix @@ -60,7 +60,6 @@ mkNixPak { sloth.xdgVideosDir ]; bind.ro = [ - # To actually make Firefox run "/sys/bus/pci" ["${config.app.package}/lib/firefox" "/app/etc/firefox"] diff --git a/hardening/nixpaks/qq-desktop-item.nix b/hardening/nixpaks/qq-desktop-item.nix index 9ee0b9e9..df665d9c 100644 --- a/hardening/nixpaks/qq-desktop-item.nix +++ b/hardening/nixpaks/qq-desktop-item.nix @@ -5,7 +5,7 @@ makeDesktopItem { name = "qq"; desktopName = "QQ"; - exec = "qq %U"; + exec = "${qq}/bin/qq %U"; terminal = false; # To find the icon name(nushell): # let p = NIXPKGS_ALLOW_UNFREE=1 nix eval --impure nixpkgs#qq.outPath | str trim --char '"' diff --git a/hardening/nixpaks/wechat-uos-desktop-item.nix b/hardening/nixpaks/wechat-uos-desktop-item.nix deleted file mode 100644 index e6bb09f4..00000000 --- a/hardening/nixpaks/wechat-uos-desktop-item.nix +++ /dev/null @@ -1,17 +0,0 @@ -{ - makeDesktopItem, - wechat-uos, -}: -makeDesktopItem { - name = "wechat"; - desktopName = "WeChat"; - exec = "wechat-uos %U"; - terminal = false; - # To find the icon name(nushell): - # let p = NIXPKGS_ALLOW_UNFREE=1 nix eval --impure nixpkgs#wechat-uos.outPath | str trim --char '"' - # tree $"($p)/share/icons" - icon = "${wechat-uos}/share/icons/hicolor/256x256/apps/com.tencent.wechat.png"; - type = "Application"; - categories = ["Network"]; - comment = "Wechat boxed"; -} diff --git a/hardening/nixpaks/wechat-uos.nix b/hardening/nixpaks/wechat-uos.nix deleted file mode 100644 index 2bfb0523..00000000 --- a/hardening/nixpaks/wechat-uos.nix +++ /dev/null @@ -1,69 +0,0 @@ -# TODO: wechat-uos is running in FHS sandbox by default, it's problematic -# to wrap it again via flatpak. We need to find a way to fix it. -# https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/by-name/we/wechat-uos/package.nix -# Refer: -# - Flatpak manifest's docs: -# - https://docs.flatpak.org/en/latest/manifests.html -# - https://docs.flatpak.org/en/latest/sandbox-permissions.html -# - wechat-uos's flatpak manifest: https://github.com/flathub/com.tencent.WeChat/blob/master/com.tencent.WeChat.yaml -{ - lib, - pkgs, - mkNixPak, - ... -}: -mkNixPak { - config = {sloth, ...}: { - app = { - package = pkgs.wechat-uos; - binPath = "bin/wechat-uos"; - }; - flatpak.appId = "com.tencent.WeChat"; - - imports = [ - ./modules/gui-base.nix - ./modules/network.nix - ]; - - # list all dbus services: - # ls -al /run/current-system/sw/share/dbus-1/services/ - # ls -al /etc/profiles/per-user/ryan/share/dbus-1/services/ - dbus.policies = { - "org.gnome.Shell.Screencast" = "talk"; - # System tray icon - "org.freedesktop.Notifications" = "talk"; - "org.kde.StatusNotifierWatcher" = "talk"; - # File Manager - "org.freedesktop.FileManager1" = "talk"; - # Uses legacy StatusNotifier implementation - "org.kde.*" = "own"; - }; - bubblewrap = { - # To trace all the home files QQ accesses, you can use the following nushell command: - # just trace-access wechat-uos - # See the Justfile in the root of this repository for more information. - bind.rw = [ - # given the read write permission to the following directories. - # NOTE: sloth.mkdir is used to create the directory if it does not exist! - (sloth.mkdir (sloth.concat [sloth.homeDir "/.xwechat"])) - - sloth.xdgDocumentsDir - sloth.xdgDownloadDir - sloth.xdgMusicDir - sloth.xdgVideosDir - ]; - sockets = { - x11 = false; - wayland = true; - pipewire = true; - }; - - env = { - # Hidpi scale - "QT_AUTO_SCREEN_SCALE_FACTOR" = "1"; - # Only supports xcb - "QT_QPA_PLATFORM" = "kcb"; - }; - }; - }; -} diff --git a/home/linux/gui/base/misc.nix b/home/linux/gui/base/misc.nix index f48cb4ca..36c4f77c 100644 --- a/home/linux/gui/base/misc.nix +++ b/home/linux/gui/base/misc.nix @@ -21,7 +21,7 @@ pkgs.nixpaks.qq pkgs.nixpaks.qq-desktop-item # qqmusic - # wechat-uos + pkgs.bwraps.wechat ]; # allow fontconfig to discover fonts and configurations installed through home.packages diff --git a/hosts/idols-ai/preservation.nix b/hosts/idols-ai/preservation.nix index 6303e119..7248c2ec 100644 --- a/hosts/idols-ai/preservation.nix +++ b/hosts/idols-ai/preservation.nix @@ -232,7 +232,6 @@ in { # Instant Messaging # ====================================== ".config/QQ" - ".xwechat" ".local/share/TelegramDesktop" diff --git a/outputs/x86_64-linux/src/idols-ai.nix b/outputs/x86_64-linux/src/idols-ai.nix index deacd217..8c5d3a71 100644 --- a/outputs/x86_64-linux/src/idols-ai.nix +++ b/outputs/x86_64-linux/src/idols-ai.nix @@ -22,7 +22,7 @@ # nixos hardening # "hardening/profiles/default.nix" "hardening/nixpaks" - # "hardening/apparmor" + "hardening/bwraps" ]; home-modules = map mylib.relativeToRoot [ # common