diff options
author | Silas Schöffel <sils@sils.li> | 2024-06-07 16:57:13 +0200 |
---|---|---|
committer | Silas Schöffel <sils@sils.li> | 2024-06-07 17:49:11 +0200 |
commit | 1acb1455f0bbad09ac5abb87dcfde39cbaa5e575 (patch) | |
tree | 89eae231c1f3c52517d64d44b21ca50761e074cf /modules/nixos | |
parent | flake.lock: update (diff) | |
download | nix-config-1acb1455f0bbad09ac5abb87dcfde39cbaa5e575.tar.gz nix-config-1acb1455f0bbad09ac5abb87dcfde39cbaa5e575.zip |
firejail: wrap firefox with firejail
Diffstat (limited to '')
-rw-r--r-- | modules/nixos/sils/apparmor.nix | 14 | ||||
-rw-r--r-- | modules/nixos/sils/default.nix | 2 | ||||
-rw-r--r-- | modules/nixos/sils/firejail.nix | 24 | ||||
-rw-r--r-- | modules/nixos/sils/roles.nix | 2 |
4 files changed, 42 insertions, 0 deletions
diff --git a/modules/nixos/sils/apparmor.nix b/modules/nixos/sils/apparmor.nix new file mode 100644 index 0000000..69cec21 --- /dev/null +++ b/modules/nixos/sils/apparmor.nix @@ -0,0 +1,14 @@ +{ + config, + lib, + ... +}: let + cfg = config.sils.apparmor; +in { + options.sils.apparmor.enable = lib.mkEnableOption "apparmor"; + config = lib.mkIf cfg.enable { + security.apparmor = { + enable = true; + }; + }; +} diff --git a/modules/nixos/sils/default.nix b/modules/nixos/sils/default.nix index a0fe1ac..922d706 100644 --- a/modules/nixos/sils/default.nix +++ b/modules/nixos/sils/default.nix @@ -1,8 +1,10 @@ {...}: { imports = [ + ./apparmor.nix ./basesystem.nix ./bluetooth.nix ./environment.nix + ./firejail.nix ./font.nix ./hyprland.nix ./impermanence.nix diff --git a/modules/nixos/sils/firejail.nix b/modules/nixos/sils/firejail.nix new file mode 100644 index 0000000..d5df71f --- /dev/null +++ b/modules/nixos/sils/firejail.nix @@ -0,0 +1,24 @@ +{ + config, + lib, + pkgs, + ... +}: let + cfg = config.sils.firejail; +in { + options.sils.firejail.enable = lib.mkEnableOption "firejail"; + config = lib.mkIf cfg.enable { + sils.apparmor.enable = true; + programs.firejail = { + enable = true; + wrappedBinaries = { + firefox = { + executable = "${lib.getExe pkgs.firefox}"; # config.home-manager.users.sils.programs.firefox.package}"; + profile = "${pkgs.firejail}/etc/firejail/firefox.profile"; + }; + }; + }; + + home-manager.users.sils.programs.firefox.package = null; + }; +} diff --git a/modules/nixos/sils/roles.nix b/modules/nixos/sils/roles.nix index 94511b9..a6c1d36 100644 --- a/modules/nixos/sils/roles.nix +++ b/modules/nixos/sils/roles.nix @@ -4,9 +4,11 @@ in { config.sils = if roleCmp "laptop" then { + apparmor.enable = true; basesystem.enable = true; bluetooth.enable = true; environment.enable = true; + firejail.enable = true; font.enable = true; hyprland.enable = true; impermanence.enable = true; |