starred/nix-config-ryan4yin
1
0
Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-01-11 22:30:25 +01:00
Code Issues Packages Projects Releases 10 Wiki Activity

feat: add WeChat(UOS) sandboxed

Browse Source 
fix: mkdir - persist qq's config
feat: update kernel params for nvidia
This commit is contained in:
Ryan Yin
2024-11-13 20:23:32 +08:00
parent fd776a0c0a
commit ab8fd424d8
9 changed files with 125 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
hardening/nixpaks/default.nix
View File

@@ -22,6 +22,9 @@ in {
qq = wrapper super ./qq.nix;
qq-desktop-item = super.callPackage ./qq-desktop-item.nix {};
wechat-uos = wrapper super ./wechat-uos.nix;
wechat-uos-desktop-item = super.callPackage ./wechat-uos-desktop-item.nix {};
firefox = wrapper super ./firefox.nix;
firefox-desktop-item = super.callPackage ./firefox-desktop-item.nix {};
};

9
hardening/nixpaks/firefox.nix
View File

@@ -37,10 +37,15 @@ mkNixPak {
};
bubblewrap = {
# To trace all the home files QQ accesses, you can use the following nushell command:
# just trace-access firefox
# See the Justfile in the root of this repository for more information.
bind.rw = [
(sloth.concat' sloth.homeDir "/.mozilla")
(sloth.concat' sloth.homeDir "/Downloads")
# given the read write permission to the following directories.
# NOTE: sloth.mkdir is used to create the directory if it does not exist!
(sloth.mkdir (sloth.concat' sloth.homeDir "/.mozilla"))
sloth.xdgDownloadDir
# ================ for externsions ===============================
# required by https://github.com/browserpass/browserpass-extension
(sloth.concat' sloth.homeDir "/.local/share/password-store") # pass

4
hardening/nixpaks/qq-desktop-item.nix
View File

@@ -7,7 +7,9 @@ makeDesktopItem {
desktopName = "QQ";
exec = "qq %U";
terminal = false;
# icon = "qq";
# To find the icon name(nushell):
# let p = NIXPKGS_ALLOW_UNFREE=1 nix eval --impure nixpkgs#qq.outPath | str trim --char '"'
# tree $"($p)/share/icons"
icon = "${qq}/share/icons/hicolor/512x512/apps/qq.png";
type = "Application";
categories = ["Network"];

7
hardening/nixpaks/qq.nix
View File

@@ -34,8 +34,13 @@ mkNixPak {
"org.kde.StatusNotifierWatcher" = "talk";
};
bubblewrap = {
# To trace all the home files QQ accesses, you can use the following nushell command:
# just trace-access qq
# See the Justfile in the root of this repository for more information.
bind.rw = [
(sloth.concat [sloth.xdgConfigHome "/QQ"])
# given the read write permission to the following directories.
# NOTE: sloth.mkdir is used to create the directory if it does not exist!
(sloth.mkdir (sloth.concat [sloth.xdgConfigHome "/QQ"]))
(sloth.mkdir (sloth.concat [sloth.xdgDownloadDir "/QQ"]))
];
sockets = {

17
hardening/nixpaks/wechat-uos-desktop-item.nix Normal file
View File

@@ -0,0 +1,17 @@
{
makeDesktopItem,
wechat-uos,
}:
makeDesktopItem {
name = "wechat";
desktopName = "WeChat";
exec = "wechat-uos %U";
terminal = false;
# To find the icon name(nushell):
# let p = NIXPKGS_ALLOW_UNFREE=1 nix eval --impure nixpkgs#wechat-uos.outPath | str trim --char '"'
# tree $"($p)/share/icons"
icon = "${wechat-uos}/share/icons/hicolor/256x256/apps/com.tencent.wechat.png";
type = "Application";
categories = ["Network"];
comment = "Wechat boxed";
}

73
hardening/nixpaks/wechat-uos.nix Normal file
View File

@@ -0,0 +1,73 @@
# TODO: wechat-uos is running in FHS sandbox by default, it's problematic
# to wrap it again via flatpak. We need to find a way to fix it.
# https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/by-name/we/wechat-uos/package.nix
# Refer:
# - Flatpak manifest's docs:
# - https://docs.flatpak.org/en/latest/manifests.html
# - https://docs.flatpak.org/en/latest/sandbox-permissions.html
# - wechat-uos's flatpak manifest: https://github.com/flathub/com.tencent.WeChat/blob/master/com.tencent.WeChat.yaml
{
lib,
pkgs,
mkNixPak,
...
}:
mkNixPak {
config = {sloth, ...}: {
app = {
package = pkgs.wechat-uos;
binPath = "bin/wechat-uos";
};
flatpak.appId = "com.tencent.WeChat";
imports = [
./modules/gui-base.nix
./modules/network.nix
];
# list all dbus services:
# ls -al /run/current-system/sw/share/dbus-1/services/
# ls -al /etc/profiles/per-user/ryan/share/dbus-1/services/
dbus.policies = {
"org.gnome.Shell.Screencast" = "talk";
# System tray icon
"org.freedesktop.Notifications" = "talk";
"org.kde.StatusNotifierWatcher" = "talk";
# File Manager
"org.freedesktop.FileManager1" = "talk";
# Uses legacy StatusNotifier implementation
"org.kde.*" = "own";
};
bubblewrap = {
# To trace all the home files QQ accesses, you can use the following nushell command:
# just trace-access wechat-uos
# See the Justfile in the root of this repository for more information.
bind.rw = [
# given the read write permission to the following directories.
# NOTE: sloth.mkdir is used to create the directory if it does not exist!
(sloth.mkdir (sloth.concat [sloth.homeDir "/.xwechat"]))
(sloth.mkdir (sloth.concat [sloth.xdgDocumentsDir "/xwechat_files"]))
(sloth.mkdir (sloth.concat [sloth.xdgDocumentsDir "/WeChat_Data/"]))
(sloth.mkdir (sloth.concat [sloth.xdgDownloadDir "/WeChat"]))
];
sockets = {
x11 = false;
wayland = true;
pipewire = true;
};
bind.dev = [
"/dev/shm" # Shared Memory
];
tmpfs = [
"/tmp"
];
env = {
# Hidpi scale
"QT_AUTO_SCREEN_SCALE_FACTOR" = "1";
# Only supports xcb
"QT_QPA_PLATFORM" = "kcb";
};
};
};
}