mkFirejailWrapper wip

Author: functora

nix/configuration.nix

@@ -90,66 +90,121 @@
     pkg,
     exe,
     dir,
-    cfg ? "",
+    net ? false,
   }: {
     "${pkg}" = {
       executable = exe;
-      profile = pkgs.writeText "${pkg}.local" (
-        ''
-          include default.profile
+      profile = mkFirejailProfile {inherit pkg dir net;};
+    };
+  };
+  mkFirejailProfile = {
+    pkg,
+    dir,
+    net ? false,
+  }:
+    pkgs.writeText "${pkg}.local" ''
+      include default.profile
 
-          include disable-X11.inc
-          include disable-common.inc
-          include disable-devel.inc
-          include disable-exec.inc
-          include disable-interpreters.inc
-          include disable-proc.inc
-          include disable-programs.inc
-          include disable-shell.inc
-          include disable-write-mnt.inc
-          include disable-xdg.inc
+      include disable-X11.inc
+      include disable-common.inc
+      include disable-devel.inc
+      include disable-exec.inc
+      include disable-interpreters.inc
+      include disable-proc.inc
+      include disable-programs.inc
+      include disable-shell.inc
+      include disable-write-mnt.inc
+      include disable-xdg.inc
 
-          # no3d
-          # nosound
-          apparmor
-          caps.drop all
-          machine-id
-          net none
-          netfilter
-          nodvd
-          nogroups
-          noinput
-          nonewprivs
-          noprinters
-          noroot
-          notv
-          nou2f
-          novideo
-          shell none
+      # no3d
+      # nosound
+      apparmor
+      caps.drop all
+      machine-id
+      ${
+        if net
+        then ""
+        else "net none"
+      }
+      netfilter
+      nodvd
+      nogroups
+      noinput
+      nonewprivs
+      noprinters
+      noroot
+      notv
+      nou2f
+      novideo
+      shell none
 
-          disable-mnt
-          private ''${HOME}/.firejail/${dir}
-          private-bin none
-          private-cache
-          private-cwd
-          private-dev
-          private-etc none
-          private-lib none
-          private-opt none
-          private-srv none
-          private-tmp
-          seccomp
-          x11 none
+      disable-mnt
+      private ''${HOME}/.firejail/${dir}
+      private-bin none
+      private-cache
+      private-cwd
+      private-dev
+      ${
+        if net
+        then ""
+        else "private-etc none"
+      }
+      private-lib none
+      private-opt none
+      private-srv none
+      private-tmp
+      seccomp
+      ${
+        if net
+        then ""
+        else "x11 none"
+      }
 
-          dbus-system none
-          dbus-user none
+      dbus-system none
+      dbus-user none
 
-          restrict-namespaces
+      restrict-namespaces
+    '';
+  mkFirejailWrapper = {
+    pkgs,
+    pkg,
+    executable,
+    desktop ? null,
+    profile ? null,
+    extraArgs ? [],
+  }:
+    pkgs.runCommand "firejail-wrap"
+    {
+      preferLocalBuild = true;
+      allowSubstitutes = false;
+      meta.priority = -1; # take precedence over non-firejailed versions
+    }
+    (
+      let
+        firejailArgs = pkgs.lib.concatStringsSep " " (
+          extraArgs
+          ++ (
+            pkgs.lib.optional (profile != null) "--profile=${toString profile}"
+          )
+        );
+      in
         ''
-        + cfg
-      );
-    };
-  };
+          command_path="$out/bin/${pkg}"
+          mkdir -p $out/bin
+          mkdir -p $out/share/applications
+          cat <<'_EOF' >"$command_path"
+          #! ${pkgs.runtimeShell} -e
+          exec /run/wrappers/bin/firejail ${firejailArgs} -- ${
+            toString executable
+          } "$@"
+          _EOF
+          chmod 0755 "$command_path"
+        ''
+        + pkgs.lib.optionalString (desktop != null) ''
+          substitute ${desktop} $out/share/applications/$(basename ${desktop}) \
+            --replace ${executable} "$command_path"
+        ''
+    );
   mkKbd = cfg: dev: {
     config = cfg;
     device = dev;
@@ -909,6 +964,16 @@ in {
         simple-scan
         system-config-printer
         pulsemixer
+        (mkFirejailWrapper {
+          inherit pkgs;
+          pkg = "firefox-firejail";
+          executable = "${firefox-esr}/bin/firefox-esr";
+          profile = mkFirejailProfile {
+            pkg = "tabby";
+            dir = "tabby";
+            net = true;
+          };
+        })
       ];
       programs.git = {
         enable = true;