starred/nix-config-ryan4yin
1
0 Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-11-13 12:13:36 +01:00
Code Issues Packages Projects Releases 10 Wiki Activity

docs(nixpak): document intentional Firefox media limits

Browse Source
This commit is contained in:
Ryan Yin committed 2026-11-01 10:49:52 +08:00
1 parent 3e6d89b3c4
commit d54b49b799
3 files changed
+24 -14
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

hardening/README.md
+5 -1
View File
@@ -21,7 +21,7 @@ explicitly; other files use the document portal. Every app also has private writ
| App | Network | Writable paths | Grants |
| ------------ | ------------- | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- |
| Firefox | Host loopback | `~/.mozilla`, personal files, Trash, Firefox artwork | Media, browserpass, MPRIS, idle |
| Firefox | Host loopback | `~/.mozilla`, personal files, Trash, Firefox artwork | Audio, browserpass, MPRIS, idle; camera/screen sharing intentionally unavailable |
| Chromium | Host loopback | `~/.config/chromium`, personal files | Media, browserpass, MPRIS, idle, v12 Secret |
| Chrome | Isolated | `~/.config/google-chrome`, Downloads | Media, browserpass, MPRIS, idle, v12 Secret |
| Brave Origin | Isolated | `~/.config/BraveSoftware/Brave-Origin`, Downloads | v12 Secret |
@@ -56,6 +56,10 @@ All browsers get read-only NSS certificates, printing, native notifications and
- pasta isolates loopback, not LAN access. Chromecast discovery is unverified.
- Brave Origin and Edge intentionally have no PulseAudio, Camera, ScreenCast or MPRIS grants. They
are backup browsers, not media browsers.
- Firefox camera and remote screen sharing are intentionally disabled. Firefox does not support the
XDG Camera/ScreenCast portal path used here, so granting camera or screen-capture access would
require widening the sandbox with raw `/dev/video*` or direct PipeWire access. We choose not to
grant that privilege.
## Validation
hardening/tests/runtime-validation.md
+15 -12
View File
@@ -12,18 +12,18 @@ Nixpak wrappers are accepted in three layers:
## Current status
| App | Policy/build | Runtime |
| ---------------------- | ------------ | ----------------------------------------------------- |
| Firefox | Pass | Interactive pass |
| Chromium | Pass | Automated smoke + interactive pass |
| Chrome | Pass | Interactive pass |
| Brave Origin | Pass | Interactive pass; backup browser without media grants |
| Edge | Pass | Interactive pass; backup browser without media grants |
| Zoom | Pass | Interactive pass |
| QQ / Telegram | Pass | Interactive startup/tray pass |
| WeChat (native nixpak) | Pass | Interactive Wayland validation pending |
| Foliate | Pass | Interactive validation pending |
| Krita | Pass | Interactive validation pending |
| App | Policy/build | Runtime |
| ---------------------- | ------------ | ----------------------------------------------------------------- |
| Firefox | Pass | Interactive pass; camera/remote sharing intentionally unavailable |
| Chromium | Pass | Automated smoke + interactive pass |
| Chrome | Pass | Interactive pass |
| Brave Origin | Pass | Interactive pass; backup browser without media grants |
| Edge | Pass | Interactive pass; backup browser without media grants |
| Zoom | Pass | Interactive pass |
| QQ / Telegram | Pass | Interactive startup/tray pass |
| WeChat (native nixpak) | Pass | Interactive Wayland validation pending |
| Foliate | Pass | Interactive validation pending |
| Krita | Pass | Interactive validation pending |
Intentional exceptions:
@@ -31,6 +31,9 @@ Intentional exceptions:
exception. Chrome, Brave Origin and Edge use pasta-isolated loopback.
- **Brave Origin and Edge are backup browsers.** They intentionally have no PulseAudio, Camera,
ScreenCast or MPRIS grants.
- **Firefox camera and remote screen sharing are intentionally disabled.** Firefox does not support
the XDG Camera/ScreenCast portal path used here, so enabling them would require granting raw video
devices or the direct PipeWire socket. We deliberately do not grant those privileges.
## Browser smoke test