Skip to content

Commit 8ce8971

Browse files
functorafunctora
committed
firejail services wip
1 parent 6007ac5 commit 8ce8971

File tree

3 files changed

+178
-138
lines changed

3 files changed

+178
-138
lines changed

‎nix/configuration.nix‎

Lines changed: 9 additions & 136 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
...
66
}: let
77
vi = import ./../pub/vi/nix/default.nix {};
8+
fj = import ./firejail.nix;
89
dns = ["8.8.8.8" "8.8.4.4"];
910
unst = import ./nixpkgs-unstable.nix;
1011
vkdoom = import ./vkdoom.nix {inherit pkgs;};
@@ -80,134 +81,6 @@
8081
${pkgs.glib}/bin/gsettings set $gnome_schema gtk-theme 'Dracula'
8182
'';
8283
};
83-
mkFirejailSimple = pkg: {
84-
"${pkg}" = {
85-
executable = "${pkgs."${pkg}"}/bin/${pkg}";
86-
profile = "${pkgs.firejail}/etc/firejail/${pkg}.profile";
87-
};
88-
};
89-
mkFirejailCustom = {
90-
pkg,
91-
exe,
92-
dir,
93-
net ? false,
94-
cfg ? "",
95-
}: {
96-
"${pkg}" = {
97-
executable = exe;
98-
profile = mkFirejailProfile {inherit pkg dir net cfg;};
99-
};
100-
};
101-
mkFirejailProfile = {
102-
pkg,
103-
dir,
104-
net,
105-
cfg,
106-
}:
107-
pkgs.writeText "${pkg}.local" (
108-
''
109-
include default.profile
110-
111-
include disable-X11.inc
112-
include disable-common.inc
113-
include disable-devel.inc
114-
include disable-exec.inc
115-
include disable-interpreters.inc
116-
include disable-proc.inc
117-
include disable-programs.inc
118-
include disable-shell.inc
119-
include disable-write-mnt.inc
120-
include disable-xdg.inc
121-
122-
# no3d
123-
# nosound
124-
apparmor
125-
caps.drop all
126-
machine-id
127-
${
128-
if net
129-
then ""
130-
else "net none"
131-
}
132-
netfilter
133-
nodvd
134-
nogroups
135-
noinput
136-
nonewprivs
137-
noprinters
138-
noroot
139-
notv
140-
nou2f
141-
novideo
142-
shell none
143-
144-
disable-mnt
145-
private ''${HOME}/.firejail/${dir}
146-
private-bin none
147-
private-cache
148-
private-cwd
149-
private-dev
150-
${
151-
if net
152-
then ""
153-
else "private-etc none"
154-
}
155-
private-lib none
156-
private-opt none
157-
private-srv none
158-
private-tmp
159-
seccomp
160-
${
161-
if net
162-
then ""
163-
else "x11 none"
164-
}
165-
166-
dbus-system none
167-
dbus-user none
168-
169-
restrict-namespaces
170-
''
171-
+ cfg
172-
);
173-
mkFirejailWrapper = {
174-
pkgs,
175-
pkg,
176-
exe,
177-
desktop ? null,
178-
profile ? null,
179-
extraArgs ? [],
180-
}:
181-
pkgs.runCommand "firejail-wrap"
182-
{
183-
preferLocalBuild = true;
184-
allowSubstitutes = false;
185-
meta.priority = -1; # take precedence over non-firejailed versions
186-
}
187-
(
188-
let
189-
firejailArgs = pkgs.lib.concatStringsSep " " (
190-
extraArgs
191-
++ (
192-
pkgs.lib.optional (profile != null) "--profile=${toString profile}"
193-
)
194-
);
195-
in
196-
''
197-
command_path="$out/bin/${pkg}"
198-
mkdir -p $out/bin
199-
mkdir -p $out/share/applications
200-
cat <<'_EOF' >"$command_path"
201-
#! ${pkgs.runtimeShell} -e
202-
exec /run/wrappers/bin/firejail ${firejailArgs} -- ${toString exe} "$@"
203-
_EOF
204-
chmod 0755 "$command_path"
205-
''
206-
+ pkgs.lib.optionalString (desktop != null) ''
207-
substitute ${desktop} $out/share/applications/$(basename ${desktop}) \
208-
--replace ${exe} "$command_path"
209-
''
210-
);
21184
mkKbd = cfg: dev: {
21285
config = cfg;
21386
device = dev;
@@ -862,8 +735,8 @@ in {
862735
#
863736
programs.firejail.enable = true;
864737
programs.firejail.wrappedBinaries =
865-
mkFirejailSimple "xonotic"
866-
// mkFirejailCustom {
738+
fj.mkFirejailSimple "xonotic"
739+
// fj.mkFirejailCustom {
867740
pkg = "openarena";
868741
dir = "q3";
869742
exe = ''
@@ -872,7 +745,7 @@ in {
872745
+set fs_game excessiveplus +set vm_cgame 2 +set vm_ui 2
873746
'';
874747
}
875-
// mkFirejailCustom {
748+
// fj.mkFirejailCustom {
876749
pkg = "doom-free2";
877750
dir = "doom";
878751
exe = ''
@@ -882,7 +755,7 @@ in {
882755
-file ./SimpleSlots.1.1.pk7
883756
'';
884757
}
885-
// mkFirejailCustom {
758+
// fj.mkFirejailCustom {
886759
pkg = "doom-dsc";
887760
dir = "doom";
888761
exe = ''
@@ -894,7 +767,7 @@ in {
894767
-file ./SimpleSlots.1.1.pk7
895768
'';
896769
}
897-
// mkFirejailCustom {
770+
// fj.mkFirejailCustom {
898771
pkg = "doom-ashes1";
899772
dir = "doom";
900773
exe = ''
@@ -907,7 +780,7 @@ in {
907780
-file ./SimpleSlots.1.1.pk7
908781
'';
909782
}
910-
// mkFirejailCustom {
783+
// fj.mkFirejailCustom {
911784
pkg = "tabby-download-embed";
912785
dir = "tabby";
913786
net = true;
@@ -916,7 +789,7 @@ in {
916789
download --model Nomic-Embed-Text
917790
'';
918791
}
919-
// mkFirejailCustom {
792+
// fj.mkFirejailCustom {
920793
pkg = "tabby-download-qwen";
921794
dir = "tabby";
922795
net = true;
@@ -925,7 +798,7 @@ in {
925798
download --model Qwen2.5-Coder-0.5B
926799
'';
927800
}
928-
// mkFirejailCustom {
801+
// fj.mkFirejailCustom {
929802
pkg = "tabby-serve-qwen";
930803
dir = "tabby";
931804
cfg = ''

‎nix/firejail.nix‎

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
let
2+
misc = import ./misc.nix;
3+
pkgs = import ./nixpkgs.nix;
4+
in rec {
5+
mkFirejailSimple = pkg: {
6+
"${pkg}" = {
7+
executable = "${pkgs."${pkg}"}/bin/${pkg}";
8+
profile = "${pkgs.firejail}/etc/firejail/${pkg}.profile";
9+
};
10+
};
11+
mkFirejailCustom = {
12+
pkg,
13+
exe,
14+
dir,
15+
net ? false,
16+
cfg ? "",
17+
}: {
18+
"${pkg}" = {
19+
executable = exe;
20+
profile = mkFirejailProfile {inherit pkg dir net cfg;};
21+
};
22+
};
23+
mkFirejailProfile = {
24+
pkg,
25+
dir,
26+
net,
27+
cfg,
28+
}:
29+
pkgs.writeText "${pkg}.local" (
30+
''
31+
include default.profile
32+
33+
include disable-X11.inc
34+
include disable-common.inc
35+
include disable-devel.inc
36+
include disable-exec.inc
37+
include disable-interpreters.inc
38+
include disable-proc.inc
39+
include disable-programs.inc
40+
include disable-shell.inc
41+
include disable-write-mnt.inc
42+
include disable-xdg.inc
43+
44+
# no3d
45+
# nosound
46+
apparmor
47+
caps.drop all
48+
machine-id
49+
${
50+
if net
51+
then ""
52+
else "net none"
53+
}
54+
netfilter
55+
nodvd
56+
nogroups
57+
noinput
58+
nonewprivs
59+
noprinters
60+
noroot
61+
notv
62+
nou2f
63+
novideo
64+
shell none
65+
66+
disable-mnt
67+
private ''${HOME}/.firejail/${dir}
68+
private-bin none
69+
private-cache
70+
private-cwd
71+
private-dev
72+
${
73+
if net
74+
then ""
75+
else "private-etc none"
76+
}
77+
private-lib none
78+
private-opt none
79+
private-srv none
80+
private-tmp
81+
seccomp
82+
${
83+
if net
84+
then ""
85+
else "x11 none"
86+
}
87+
88+
dbus-system none
89+
dbus-user none
90+
91+
restrict-namespaces
92+
''
93+
+ cfg
94+
);
95+
mkFirejailWrapper = {
96+
pkg,
97+
exe,
98+
dir,
99+
net ? false,
100+
cfg ? "",
101+
desktop ? null,
102+
profile ? mkFirejailProfile {inherit pkg dir net cfg;},
103+
extraArgs ? [],
104+
}:
105+
pkgs.runCommand "firejail-wrap"
106+
{
107+
preferLocalBuild = true;
108+
allowSubstitutes = false;
109+
meta.priority = -1; # take precedence over non-firejailed versions
110+
}
111+
(
112+
let
113+
firejailArgs = pkgs.lib.concatStringsSep " " (
114+
extraArgs
115+
++ (
116+
pkgs.lib.optional (profile != null) "--profile=${toString profile}"
117+
)
118+
);
119+
in
120+
''
121+
command_path="$out/bin/${pkg}"
122+
mkdir -p $out/bin
123+
mkdir -p $out/share/applications
124+
cat <<'_EOF' >"$command_path"
125+
#! ${pkgs.runtimeShell} -e
126+
exec /run/wrappers/bin/firejail ${firejailArgs} -- ${toString exe} "$@"
127+
_EOF
128+
chmod 0755 "$command_path"
129+
''
130+
+ pkgs.lib.optionalString (desktop != null) ''
131+
substitute ${desktop} $out/share/applications/$(basename ${desktop}) \
132+
--replace ${exe} "$command_path"
133+
''
134+
);
135+
mkFirejailService = {
136+
pkg,
137+
exe,
138+
dir,
139+
net ? false,
140+
cfg ? "",
141+
desktop ? null,
142+
profile ? mkFirejailProfile {inherit pkg dir net cfg;},
143+
extraArgs ? [],
144+
}:
145+
misc.mkService {
146+
srv = pkg;
147+
exe = mkFirejailWrapper {
148+
inherit
149+
pkg
150+
exe
151+
dir
152+
net
153+
cfg
154+
desktop
155+
profile
156+
extraArgs
157+
;
158+
};
159+
};
160+
}

‎nix/misc.nix‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,11 @@ in
6060
}${sub} --disable-optimization --repl-options=-fobject-code --repl-options=-fno-break-on-exception --repl-options=-fno-break-on-error --repl-options=-v1 --repl-options=-ferror-spans --repl-options=-j -fghcid")
6161
'';
6262
};
63-
mkService = srv: usr: exe: {
63+
mkService = {
64+
srv,
65+
usr ? null,
66+
exe,
67+
}: {
6468
lib,
6569
pkgs,
6670
config,
@@ -85,7 +89,10 @@ in
8589
wantedBy = ["default.target"];
8690
script = "PATH=$PATH:${pkgs.busybox}/bin ${exe}";
8791
serviceConfig = {
88-
User = usr;
92+
User =
93+
if usr == null
94+
then config.services.functora.userName
95+
else usr;
8996
Restart = "on-failure";
9097
};
9198
};

0 commit comments

Comments
 (0)