From 34e984fb92b131b81988c600baa1ad69f10d1230 Mon Sep 17 00:00:00 2001 From: Ryan Yin Date: Fri, 6 Nov 2026 18:26:17 +0800 Subject: [PATCH] fix(nixpak): give QQ an X11 connection for its clipboard QQ copies through the X11 CLIPBOARD even with a Wayland window; without an X server it exited on copy. QQ now shares XWayland's display trust, like WeChat. Assisted-by: DeepSeek Harness (claude-opus-5-5) --- docs/SECURITY.md | 2 +- hardening/README.md | 4 ++-- hardening/nixpaks/qq.nix | 7 +++++++ hardening/tests/policy/qq.nix | 1 + 4 files changed, 11 insertions(+), 3 deletions(-) diff --git a/docs/SECURITY.md b/docs/SECURITY.md index 89bfaa29..3c62da78 100644 --- a/docs/SECURITY.md +++ b/docs/SECURITY.md @@ -339,7 +339,7 @@ isolation. Source review and socket metadata—not reads of private credentials - Nixpak supplements Chromium's renderer sandbox, which remains enabled. Zoom/WeChat retain their FHS runtimes inside the outer boundary; inner mounts cannot recover hidden host resources. - Desktop access has limits: GPU drivers remain exposed, PulseAudio permits recording, read-only - sockets permit agent operations, and Zoom/WeChat's X11 connections have shared-display trust. + sockets permit agent operations, and Zoom/WeChat/QQ's X11 connections have shared-display trust. Zoom's 7.2.1 client receives only `/dev/video0` and `/dev/video1` because it captures the webcam directly via V4L2; no other app gets raw camera nodes and no raw PipeWire access is added. Chromium-family browsers use only the app-scoped Secret portal for v12 cookie encryption; no diff --git a/hardening/README.md b/hardening/README.md index 2454db08..8f9ec588 100644 --- a/hardening/README.md +++ b/hardening/README.md @@ -39,7 +39,7 @@ explicitly; other files use the document portal. Every app also has private writ | Chrome | Isolated | `~/.config/google-chrome`, Downloads | Media, browserpass, MPRIS, idle, FIDO2 key, v12 Secret | | Brave Origin | Isolated | `~/.config/BraveSoftware/Brave-Origin`, Downloads | v12 Secret | | Edge | Isolated | `~/.config/microsoft-edge`, Downloads | v12 Secret | -| QQ | Isolated | Personal files, private app state | Media, notifications, tray, MPRIS, idle, accessibility | +| QQ | Isolated | Personal files, private app state | Media, X11 fallback, notifications, tray, MPRIS, idle, accessibility | | Telegram | Isolated | Personal files, private app state | Media, notifications, tray, MPRIS, idle, accessibility, Ayatana indicators | | Zoom | Isolated | `~/.zoom`, `zoomus.conf`, `zoom.conf`, Downloads, `Documents/Zoom`, private app state | Media, X11/XWayland, FHS, SNI tray, idle, `/dev/video0-1`, read-only `/sys/class/drm` | | WeChat | Isolated | Documents, Downloads, app-scoped `wechat` data, private app state | Media, Wayland, X11 fallback, SNI tray, file chooser portal | @@ -114,7 +114,7 @@ games cannot read host data, not that they are isolated from each other: ## Limits -- X11: Zoom, WeChat and the game launchers have shared-display trust; portal permissions cannot +- X11: Zoom, WeChat, QQ and the game launchers have shared-display trust; portal permissions cannot enforce portal-only capture. - PulseAudio grants recording authority. Read-only GPG sockets still permit signing and decryption. - pasta isolates loopback, not LAN access. Chromecast discovery is unverified. diff --git a/hardening/nixpaks/qq.nix b/hardening/nixpaks/qq.nix index 79e31db9..24dc76d6 100644 --- a/hardening/nixpaks/qq.nix +++ b/hardening/nixpaks/qq.nix @@ -47,6 +47,13 @@ let }; bubblewrap = { + # QQ renders through Wayland but still uses the X11 clipboard; like WeChat, + # keep an X11 fallback so copying does not lose its X connection. + sockets.x11 = true; + env = { + DISPLAY = sloth.envOr "DISPLAY" ""; + XAUTHORITY = sloth.envOr "XAUTHORITY" (sloth.concat' sloth.homeDir "/.Xauthority"); + }; # To trace all the home files QQ accesses, you can use the following nushell command: # just trace-access qq # See the Justfile in the root of this repository for more information. diff --git a/hardening/tests/policy/qq.nix b/hardening/tests/policy/qq.nix index 3910f36b..1bd5e175 100644 --- a/hardening/tests/policy/qq.nix +++ b/hardening/tests/policy/qq.nix @@ -4,5 +4,6 @@ mkAppPolicy "qq" { media = true; mpris = true; notifications = true; + x11 = true; tray = true; }