add default exception for nix (#1581)

Author: matt-phylum

CHANGELOG.md

@@ -8,6 +8,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ## Unreleased
 
+### Added
+
+- Nix store access to the default sandbox
+
 ### Fixed
 
 - Unclear error when running `phylum init` with an invalid organization

cli/src/permissions.rs

@@ -310,6 +310,9 @@ pub fn default_sandbox() -> SandboxResult<Birdcage> {
     add_exception(&mut birdcage, Exception::ExecuteAndRead("/opt/homebrew".into()))?;
     add_exception(&mut birdcage, Exception::ExecuteAndRead("/usr/local".into()))?;
 
+    // NixOS stores all system files under /nix/store.
+    add_exception(&mut birdcage, Exception::ExecuteAndRead("/nix/store".into()))?;
+
     // Allow access to DNS list.
     //
     // While this is required to send DNS requests for network queries, this does