nixpkgs/overlays/firejail.nix

   1 pkgs: _previousPkgs: {
   2   firejailWrap =
   3     {
   4       package,
   5       paths ? [ "bin/${package.meta.mainProgram or (pkgs.lib.getName package)}" ],
   6       name ? package.name + "-firejailed",
   7       firejail ? "/run/wrappers/bin/firejail",
   8       args ? [ ],
   9     }:
  10     pkgs.symlinkJoin {
  11       inherit name;
  12       # DevelopmentNode: you may have to inherit more attributes.
  13       inherit (package) meta passthru;
  14       paths = [ package ];
  15       nativeBuildInputs = [ pkgs.makeShellWrapper ];
  16       postBuild = ''
  17         # ExplanationNote: /run/wrappers/ is not yet available
  18         # hence disable that check in makeShellWrapper.
  19         assertExecutable () { true; }
  20         for path in ${pkgs.lib.escapeShellArgs paths}; do
  21           rm "$out/$path"
  22           # CorrectnessNote: in case the resulting package is called
  23           # when building a derivation (eg. in neovim: Generating remote plugin manifest)
  24           # /run/wrappers/ does not exist, hence just bypass firejail using a --run.
  25           makeShellWrapper \
  26             ${firejail} \
  27             "$out/$path" \
  28             --run "[ -x ${firejail} ] || exec \"${package}/$path\" \"\$@\"" \
  29             --add-flags "${pkgs.lib.escapeShellArgs args}" \
  30             --add-flags "${package}/$path" \
  31             --inherit-argv0
  32         done
  33       '';
  34     };
  35 }