mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-07-14 00:22:39 +02:00
feat: hardening nixos desktops (#160)
* feat: hardening nixos desktops * refactor: move hardening to the root folder * feat: add nixpaks into nixpkgs via overlays * feat: nixpak - add netease music * docs: hardening * fix: nvidia * fix: disable apparmor & hardening profile to avoid neovim being killed * fix: firefox cursor & fonts
This commit is contained in:
Ryan Yin
@@ -0,0 +1,30 @@
|
||||
{
|
||||
pkgs,
|
||||
nixpak,
|
||||
...
|
||||
}: let
|
||||
callArgs = {
|
||||
mkNixPak = nixpak.lib.nixpak {
|
||||
inherit (pkgs) lib;
|
||||
inherit pkgs;
|
||||
};
|
||||
safeBind = sloth: realdir: mapdir: [
|
||||
(sloth.mkdir (sloth.concat' sloth.appDataDir realdir))
|
||||
(sloth.concat' sloth.homeDir mapdir)
|
||||
];
|
||||
};
|
||||
wrapper = _pkgs: path: (_pkgs.callPackage path callArgs).config.script;
|
||||
in {
|
||||
# Add nixpaked Apps into nixpkgs, and reference them in home-manager or other nixos modules
|
||||
nixpkgs.overlays = [
|
||||
(_: super: {
|
||||
nixpaks = {
|
||||
qq = wrapper super ./qq.nix;
|
||||
qq-desktop-item = super.callPackage ./qq-desktop-item.nix {};
|
||||
|
||||
firefox = wrapper super ./firefox.nix;
|
||||
firefox-desktop-item = super.callPackage ./firefox-desktop-item.nix {};
|
||||
};
|
||||
})
|
||||
];
|
||||
}
|
||||
@@ -0,0 +1,11 @@
|
||||
{makeDesktopItem}:
|
||||
makeDesktopItem {
|
||||
name = "firefox";
|
||||
desktopName = "firefox";
|
||||
exec = "firefox %U";
|
||||
terminal = false;
|
||||
icon = "firefox";
|
||||
type = "Application";
|
||||
categories = ["Network"];
|
||||
comment = "firefox boxed";
|
||||
}
|
||||
@@ -0,0 +1,75 @@
|
||||
# Refer:
|
||||
# - Flatpak manifest's docs:
|
||||
# - https://docs.flatpak.org/en/latest/manifests.html
|
||||
# - https://docs.flatpak.org/en/latest/sandbox-permissions.html
|
||||
# - Firefox's flatpak manifest: https://hg.mozilla.org/mozilla-central/file/tip/taskcluster/docker/firefox-flatpak/runme.sh#l151
|
||||
{
|
||||
lib,
|
||||
pkgs,
|
||||
mkNixPak,
|
||||
...
|
||||
}:
|
||||
mkNixPak {
|
||||
config = {
|
||||
config,
|
||||
sloth,
|
||||
...
|
||||
}: {
|
||||
app = {
|
||||
package = pkgs.firefox-wayland;
|
||||
binPath = "bin/firefox";
|
||||
};
|
||||
flatpak.appId = "org.mozilla.firefox";
|
||||
|
||||
imports = [
|
||||
./modules/gui-base.nix
|
||||
./modules/network.nix
|
||||
];
|
||||
|
||||
# list all dbus services:
|
||||
# ls -al /run/current-system/sw/share/dbus-1/services/
|
||||
# ls -al /etc/profiles/per-user/ryan/share/dbus-1/services/
|
||||
dbus.policies = {
|
||||
"org.mozilla.firefox.*" = "own"; # firefox
|
||||
"org.mozilla.firefox_beta.*" = "own"; # firefox beta
|
||||
"org.mpris.MediaPlayer2.firefox.*" = "own";
|
||||
"org.freedesktop.NetworkManager" = "talk";
|
||||
};
|
||||
|
||||
bubblewrap = {
|
||||
bind.rw = [
|
||||
(sloth.concat' sloth.homeDir "/.mozilla")
|
||||
(sloth.concat' sloth.homeDir "/Downloads")
|
||||
|
||||
# ================ for externsions ===============================
|
||||
# required by https://github.com/browserpass/browserpass-extension
|
||||
(sloth.concat' sloth.homeDir "/.local/share/password-store") # pass
|
||||
];
|
||||
bind.ro = [
|
||||
# To actually make Firefox run
|
||||
"/sys/bus/pci"
|
||||
["${config.app.package}/lib/firefox" "/app/etc/firefox"]
|
||||
|
||||
# Unsure
|
||||
(sloth.concat' sloth.xdgConfigHome "/dconf")
|
||||
];
|
||||
|
||||
sockets = {
|
||||
x11 = false;
|
||||
wayland = true;
|
||||
pipewire = true;
|
||||
};
|
||||
bind.dev = [
|
||||
"/dev/shm" # Shared Memory
|
||||
|
||||
# seems required when using nvidia as primary gpu
|
||||
"/dev/nvidia0"
|
||||
"/dev/nvidia-uvm"
|
||||
"/dev/nvidia-modeset"
|
||||
];
|
||||
tmpfs = [
|
||||
"/tmp"
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,84 @@
|
||||
# https://github.com/nixpak/pkgs/blob/master/pkgs/modules/gui-base.nix
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
sloth,
|
||||
...
|
||||
}: let
|
||||
envSuffix = envKey: suffix: sloth.concat' (sloth.env envKey) suffix;
|
||||
# cursor & icon's theme should be the same as the host's one.
|
||||
cursorTheme = pkgs.bibata-cursors;
|
||||
iconTheme = pkgs.papirus-icon-theme;
|
||||
in {
|
||||
config = {
|
||||
dbus.policies = {
|
||||
"${config.flatpak.appId}" = "own";
|
||||
"org.freedesktop.DBus" = "talk";
|
||||
"org.gtk.vfs.*" = "talk";
|
||||
"org.gtk.vfs" = "talk";
|
||||
"ca.desrt.dconf" = "talk";
|
||||
"org.freedesktop.portal.*" = "talk";
|
||||
"org.a11y.Bus" = "talk";
|
||||
};
|
||||
# https://github.com/nixpak/nixpak/blob/master/modules/gpu.nix
|
||||
# 1. bind readonly - /run/opengl-driver
|
||||
# 2. bind device - /dev/dri
|
||||
gpu = {
|
||||
enable = lib.mkDefault true;
|
||||
provider = "nixos";
|
||||
bundlePackage = pkgs.mesa.drivers; # for amd & intel
|
||||
};
|
||||
# https://github.com/nixpak/nixpak/blob/master/modules/gui/fonts.nix
|
||||
# it works not well, bind system's /etc/fonts directly instead
|
||||
fonts.enable = true;
|
||||
fonts.fonts = config.fonts.packages;
|
||||
# https://github.com/nixpak/nixpak/blob/master/modules/locale.nix
|
||||
locale.enable = true;
|
||||
bubblewrap = {
|
||||
network = lib.mkDefault false;
|
||||
bind.rw = [
|
||||
[
|
||||
(envSuffix "HOME" "/.var/app/${config.flatpak.appId}/cache")
|
||||
sloth.xdgCacheHome
|
||||
]
|
||||
(sloth.concat' sloth.xdgCacheHome "/fontconfig")
|
||||
(sloth.concat' sloth.xdgCacheHome "/mesa_shader_cache")
|
||||
|
||||
(sloth.concat [
|
||||
(sloth.env "XDG_RUNTIME_DIR")
|
||||
"/"
|
||||
(sloth.envOr "WAYLAND_DISPLAY" "no")
|
||||
])
|
||||
|
||||
(envSuffix "XDG_RUNTIME_DIR" "/at-spi/bus")
|
||||
(envSuffix "XDG_RUNTIME_DIR" "/gvfsd")
|
||||
(envSuffix "XDG_RUNTIME_DIR" "/pulse")
|
||||
|
||||
"/run/dbus"
|
||||
];
|
||||
bind.ro = [
|
||||
(envSuffix "XDG_RUNTIME_DIR" "/doc")
|
||||
(sloth.concat' sloth.xdgConfigHome "/gtk-2.0")
|
||||
(sloth.concat' sloth.xdgConfigHome "/gtk-3.0")
|
||||
(sloth.concat' sloth.xdgConfigHome "/gtk-4.0")
|
||||
(sloth.concat' sloth.xdgConfigHome "/fontconfig")
|
||||
|
||||
"/etc/fonts" # for fontconfig
|
||||
"/etc/machine-id"
|
||||
"/etc/localtime"
|
||||
];
|
||||
env = {
|
||||
XDG_DATA_DIRS = lib.mkForce (lib.makeSearchPath "share" [
|
||||
iconTheme
|
||||
cursorTheme
|
||||
pkgs.shared-mime-info
|
||||
]);
|
||||
XCURSOR_PATH = lib.mkForce (lib.concatStringsSep ":" [
|
||||
"${cursorTheme}/share/icons"
|
||||
"${cursorTheme}/share/pixmaps"
|
||||
]);
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,8 @@
|
||||
# https://github.com/nixpak/pkgs/blob/master/pkgs/modules/network.nix
|
||||
{
|
||||
etc.sslCertificates.enable = true;
|
||||
bubblewrap = {
|
||||
bind.ro = ["/etc/resolv.conf"];
|
||||
network = true;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,15 @@
|
||||
{
|
||||
makeDesktopItem,
|
||||
qq,
|
||||
}:
|
||||
makeDesktopItem {
|
||||
name = "qq";
|
||||
desktopName = "QQ";
|
||||
exec = "qq %U";
|
||||
terminal = false;
|
||||
# icon = "qq";
|
||||
icon = "${qq}/share/icons/hicolor/512x512/apps/qq.png";
|
||||
type = "Application";
|
||||
categories = ["Network"];
|
||||
comment = "QQ boxed";
|
||||
}
|
||||
@@ -0,0 +1,59 @@
|
||||
# Refer:
|
||||
# - Flatpak manifest's docs:
|
||||
# - https://docs.flatpak.org/en/latest/manifests.html
|
||||
# - https://docs.flatpak.org/en/latest/sandbox-permissions.html
|
||||
# - QQ's flatpak manifest: https://github.com/flathub/com.qq.QQ/blob/master/com.qq.QQ.yaml
|
||||
{
|
||||
lib,
|
||||
pkgs,
|
||||
mkNixPak,
|
||||
...
|
||||
}:
|
||||
mkNixPak {
|
||||
config = {sloth, ...}: {
|
||||
app = {
|
||||
package = pkgs.qq.override {
|
||||
# fix fcitx5 input method
|
||||
commandLineArgs = lib.concatStringsSep " " ["--enable-wayland-ime"];
|
||||
};
|
||||
binPath = "bin/qq";
|
||||
};
|
||||
flatpak.appId = "com.tencent.qq";
|
||||
|
||||
imports = [
|
||||
./modules/gui-base.nix
|
||||
./modules/network.nix
|
||||
];
|
||||
|
||||
# list all dbus services:
|
||||
# ls -al /run/current-system/sw/share/dbus-1/services/
|
||||
# ls -al /etc/profiles/per-user/ryan/share/dbus-1/services/
|
||||
dbus.policies = {
|
||||
"org.gnome.Shell.Screencast" = "talk";
|
||||
"org.freedesktop.Notifications" = "talk";
|
||||
"org.kde.StatusNotifierWatcher" = "talk";
|
||||
};
|
||||
bubblewrap = {
|
||||
bind.rw = [
|
||||
(sloth.concat [sloth.xdgConfigHome "/QQ"])
|
||||
(sloth.mkdir (sloth.concat [sloth.xdgDownloadDir "/QQ"]))
|
||||
];
|
||||
sockets = {
|
||||
x11 = false;
|
||||
wayland = true;
|
||||
pipewire = true;
|
||||
};
|
||||
bind.dev = [
|
||||
"/dev/shm" # Shared Memory
|
||||
|
||||
# seems required when using nvidia as primary gpu
|
||||
"/dev/nvidia0"
|
||||
"/dev/nvidia-uvm"
|
||||
"/dev/nvidia-modeset"
|
||||
];
|
||||
tmpfs = [
|
||||
"/tmp"
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user