nixpkgs/overlays/firejail.nix

   1 pkgs: _previousPkgs: {
   2   firejailWrap =
   3     {
   4       package,
   5       packageName ? package.meta.mainProgram or (pkgs.lib.getName package),
   6       paths ? [ "bin/${packageName}" ],
   7       name ? package.name + "-firejailed",
   8       firejail ? "/run/wrappers/bin/firejail",
   9       args ? [ ],
  10     }:
  11     pkgs.symlinkJoin {
  12       inherit name;
  13       # DevelopmentNode: you may have to inherit more attributes.
  14       inherit (package) meta passthru;
  15       paths = [ package ];
  16       nativeBuildInputs = [ pkgs.makeShellWrapper ];
  17       postBuild = ''
  18         # ExplanationNote: /run/wrappers/ is not yet available
  19         # hence disable that check in makeShellWrapper.
  20         assertExecutable () { true; }
  21         for path in ${pkgs.lib.escapeShellArgs paths}; do
  22           rm "$out/$path"
  23           # CorrectnessNote: in case the resulting package is called
  24           # when building a derivation (eg. in neovim: Generating remote plugin manifest)
  25           # /run/wrappers/ does not exist, hence just bypass firejail using a --run.
  26           makeShellWrapper \
  27             ${firejail} \
  28             "$out/$path" \
  29             --run "[ -x ${firejail} ] || exec \"${package}/$path\" \"\$@\"" \
  30             --add-flags "${pkgs.lib.escapeShellArgs args}" \
  31             --add-flags "${package}/$path" \
  32             --inherit-argv0
  33         done
  34       '';
  35     };
  36 }