starred/nix-config-ryan4yin
1
0 Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-11-13 12:13:36 +01:00
Code Issues Packages Projects Releases 10 Wiki Activity

fix(nixpak): give QQ an X11 connection for its clipboard

Browse Source 
QQ copies through the X11 CLIPBOARD even with a Wayland window; without an X server it exited on copy. QQ now shares XWayland's display trust, like WeChat.

Assisted-by: DeepSeek Harness (claude-opus-5-5)
This commit is contained in:
Ryan Yin committed 2026-11-06 18:26:17 +08:00
1 parent 35155906c1
commit 34e984fb92
4 files changed
+11 -3
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/SECURITY.md
+1 -1
View File
@@ -339,7 +339,7 @@ isolation. Source review and socket metadata—not reads of private credentials
- Nixpak supplements Chromium's renderer sandbox, which remains enabled. Zoom/WeChat retain their - Nixpak supplements Chromium's renderer sandbox, which remains enabled. Zoom/WeChat retain their
FHS runtimes inside the outer boundary; inner mounts cannot recover hidden host resources. FHS runtimes inside the outer boundary; inner mounts cannot recover hidden host resources.
- Desktop access has limits: GPU drivers remain exposed, PulseAudio permits recording, read-only - Desktop access has limits: GPU drivers remain exposed, PulseAudio permits recording, read-only
sockets permit agent operations, and Zoom/WeChat's X11 connections have shared-display trust. sockets permit agent operations, and Zoom/WeChat/QQ's X11 connections have shared-display trust.
Zoom's 7.2.1 client receives only `/dev/video0` and `/dev/video1` because it captures the webcam Zoom's 7.2.1 client receives only `/dev/video0` and `/dev/video1` because it captures the webcam
directly via V4L2; no other app gets raw camera nodes and no raw PipeWire access is added. directly via V4L2; no other app gets raw camera nodes and no raw PipeWire access is added.
Chromium-family browsers use only the app-scoped Secret portal for v12 cookie encryption; no Chromium-family browsers use only the app-scoped Secret portal for v12 cookie encryption; no
hardening/README.md
+2 -2
View File
@@ -39,7 +39,7 @@ explicitly; other files use the document portal. Every app also has private writ
| Chrome | Isolated | `~/.config/google-chrome`, Downloads | Media, browserpass, MPRIS, idle, FIDO2 key, v12 Secret | | Chrome | Isolated | `~/.config/google-chrome`, Downloads | Media, browserpass, MPRIS, idle, FIDO2 key, v12 Secret |
| Brave Origin | Isolated | `~/.config/BraveSoftware/Brave-Origin`, Downloads | v12 Secret | | Brave Origin | Isolated | `~/.config/BraveSoftware/Brave-Origin`, Downloads | v12 Secret |
| Edge | Isolated | `~/.config/microsoft-edge`, Downloads | v12 Secret | | Edge | Isolated | `~/.config/microsoft-edge`, Downloads | v12 Secret |
| QQ | Isolated | Personal files, private app state | Media, notifications, tray, MPRIS, idle, accessibility | | QQ | Isolated | Personal files, private app state | Media, X11 fallback, notifications, tray, MPRIS, idle, accessibility |
| Telegram | Isolated | Personal files, private app state | Media, notifications, tray, MPRIS, idle, accessibility, Ayatana indicators | | Telegram | Isolated | Personal files, private app state | Media, notifications, tray, MPRIS, idle, accessibility, Ayatana indicators |
| Zoom | Isolated | `~/.zoom`, `zoomus.conf`, `zoom.conf`, Downloads, `Documents/Zoom`, private app state | Media, X11/XWayland, FHS, SNI tray, idle, `/dev/video0-1`, read-only `/sys/class/drm` | | Zoom | Isolated | `~/.zoom`, `zoomus.conf`, `zoom.conf`, Downloads, `Documents/Zoom`, private app state | Media, X11/XWayland, FHS, SNI tray, idle, `/dev/video0-1`, read-only `/sys/class/drm` |
| WeChat | Isolated | Documents, Downloads, app-scoped `wechat` data, private app state | Media, Wayland, X11 fallback, SNI tray, file chooser portal | | WeChat | Isolated | Documents, Downloads, app-scoped `wechat` data, private app state | Media, Wayland, X11 fallback, SNI tray, file chooser portal |
@@ -114,7 +114,7 @@ games cannot read host data, not that they are isolated from each other:
## Limits ## Limits
- X11: Zoom, WeChat and the game launchers have shared-display trust; portal permissions cannot - X11: Zoom, WeChat, QQ and the game launchers have shared-display trust; portal permissions cannot
enforce portal-only capture. enforce portal-only capture.
- PulseAudio grants recording authority. Read-only GPG sockets still permit signing and decryption. - PulseAudio grants recording authority. Read-only GPG sockets still permit signing and decryption.
- pasta isolates loopback, not LAN access. Chromecast discovery is unverified. - pasta isolates loopback, not LAN access. Chromecast discovery is unverified.
hardening/nixpaks/qq.nix
+7
View File
@@ -47,6 +47,13 @@ let
}; };
bubblewrap = { bubblewrap = {
# QQ renders through Wayland but still uses the X11 clipboard; like WeChat,
# keep an X11 fallback so copying does not lose its X connection.
sockets.x11 = true;
env = {
DISPLAY = sloth.envOr "DISPLAY" "";
XAUTHORITY = sloth.envOr "XAUTHORITY" (sloth.concat' sloth.homeDir "/.Xauthority");
};
# To trace all the home files QQ accesses, you can use the following nushell command: # To trace all the home files QQ accesses, you can use the following nushell command:
# just trace-access qq # just trace-access qq
# See the Justfile in the root of this repository for more information. # See the Justfile in the root of this repository for more information.
hardening/tests/policy/qq.nix
+1
View File
@@ -4,5 +4,6 @@ mkAppPolicy "qq" {
media = true; media = true;
mpris = true; mpris = true;
notifications = true; notifications = true;
x11 = true;
tray = true; tray = true;
} }