dotfiles

  1# Browser Sandbox
  2{
  3  config,
  4  inputs,
  5  lib,
  6  pkgs,
  7  ...
  8}: let
  9  appId = "org.mozilla.firefox";
 10  firefox = config.programs.firefox.finalPackage;
 11  sandbox = (inputs.nixpak.lib.nixpak {inherit lib pkgs;}) {
 12    config = {sloth, ...}: {
 13      app = {
 14        package = firefox;
 15        binPath = "bin/firefox";
 16      };
 17      flatpak.appId = appId;
 18
 19      gpu = {
 20        enable = true;
 21        provider = "nixos";
 22      };
 23      locale.enable = true;
 24      etc.sslCertificates.enable = true;
 25      dbus = {
 26        policies = {
 27          "${appId}" = "own";
 28          "${appId}.*" = "own";
 29          "org.mpris.MediaPlayer2.${appId}.*" = "own";
 30          "org.freedesktop.DBus" = "talk";
 31          "ca.desrt.dconf" = "talk";
 32          "org.freedesktop.portal.Desktop" = "talk";
 33          "org.freedesktop.portal.Documents" = "talk";
 34          "org.freedesktop.portal.FileChooser" = "talk";
 35          "org.freedesktop.portal.Notification" = "talk";
 36          "org.freedesktop.portal.OpenURI" = "talk";
 37          "org.freedesktop.portal.ScreenCast" = "talk";
 38          "org.freedesktop.portal.Camera" = "talk";
 39          "org.freedesktop.portal.Request" = "talk";
 40          "org.freedesktop.Notifications" = "talk";
 41          "org.kde.StatusNotifierWatcher" = "talk";
 42          "org.a11y.Bus" = "talk";
 43        };
 44        rules.broadcast."org.freedesktop.portal.*" = ["@/org/freedesktop/portal/*"];
 45        args = ["--filter" "--sloppy-names"];
 46      };
 47
 48      bubblewrap = {
 49        network = true;
 50        sockets = {
 51          wayland = true;
 52          pipewire = true;
 53          pulse = true;
 54          x11 = false;
 55        };
 56
 57        bind.rw = [
 58          (sloth.mkdir (sloth.concat' sloth.xdgConfigHome "/mozilla/firefox"))
 59          (sloth.mkdir (sloth.concat' sloth.xdgCacheHome "/mozilla"))
 60          sloth.xdgDownloadDir
 61
 62          (sloth.concat' sloth.runtimeDir "/at-spi/bus")
 63          (sloth.concat' sloth.runtimeDir "/doc")
 64          (sloth.concat' sloth.runtimeDir "/gvfsd")
 65          (sloth.concat' sloth.xdgCacheHome "/fontconfig")
 66
 67          (sloth.concat' sloth.runtimeDir "/app/org.keepassxc.KeePassXC")
 68        ];
 69
 70        bind.ro = [
 71          "/sys/bus/pci"
 72          "/sys/class/drm"
 73          "/run/udev/data"
 74          "/etc/egl/egl_external_platform.d"
 75          ["${firefox}/lib/firefox" "/app/etc/firefox"]
 76          (sloth.concat' sloth.homeDir "/.mozilla/native-messaging-hosts")
 77
 78          "/run/current-system"
 79          "/etc/profiles/per-user/${config.home.username}"
 80          "/etc/xdg"
 81
 82          (sloth.concat' sloth.xdgDataHome "/icons")
 83          (sloth.concat' sloth.xdgConfigHome "/gtk-3.0")
 84          (sloth.concat' sloth.xdgConfigHome "/gtk-4.0")
 85          (sloth.concat' sloth.xdgConfigHome "/fontconfig")
 86          (sloth.concat' sloth.xdgConfigHome "/dconf")
 87          "/etc/fonts"
 88          "/etc/localtime"
 89          "/etc/zoneinfo"
 90        ];
 91
 92        bind.dev = [
 93          "/dev/shm"
 94          "/dev/nvidia0"
 95          "/dev/nvidiactl"
 96          "/dev/nvidia-modeset"
 97          "/dev/nvidia-uvm"
 98        ];
 99        tmpfs = ["/tmp"];
100        newSession = true;
101      };
102    };
103  };
104in {
105  config = lib.mkIf config.programs.firefox.enable {
106    home.packages = [(lib.hiPrio sandbox.config.env)];
107  };
108}