nixpkgs/overlays/firejail.nix

   1 pkgs: _previousPkgs: {
   2   firejailWrap =
   3     {
   4       package,
   5       packageName ? package.meta.mainProgram or (pkgs.lib.getName package),
   6       paths ? [ "bin/${packageName}" ],
   7       name ? package.name + "-firejailed",
   8       args ? [ ],
   9       firejail ? "/run/wrappers/bin/firejail",
  10     }:
  11     pkgs.lib.makeOverridable (
  12       # CompatibilityNote: if .override(overrideArgs) is used
  13       # on the wrapping package (eg. if used on programs.firefox.package),
  14       # overrideArgs is passed to the wrapped package.
  15       overrideArgs:
  16       # DesignExplanation: using symlinkJoin instead of package.overrideAttrs
  17       # enables to get the wrapped package from the cache as usual.
  18       # The main drawback is that the user may have to inherit more attributes.
  19       # eg. programs.neovim.package = pkgs.firejailWrap { … } // { inherit (pkgs.neovim-unwrapped) lua; };
  20       pkgs.symlinkJoin {
  21         inherit name;
  22         meta = package.meta or { };
  23         passthru = package.passthru or { };
  24         paths = [ (package.override overrideArgs) ];
  25         nativeBuildInputs = [ pkgs.makeShellWrapper ];
  26         postBuild = ''
  27           # ExplanationNote: /run/wrappers/ is not yet available
  28           # hence disable that check in makeShellWrapper.
  29           assertExecutable () { true; }
  30           for path in ${pkgs.lib.escapeShellArgs paths}; do
  31             rm "$out/$path"
  32             # CorrectnessNote: in case the wrapping package is called
  33             # when building a derivation (eg. in neovim: Generating remote plugin manifest)
  34             # /run/wrappers/ does not exist, hence just bypass firejail using a --run.
  35             makeShellWrapper \
  36               ${firejail} \
  37               "$out/$path" \
  38               --run "[ -x ${firejail} ] || exec \"${package}/$path\" \"\$@\"" \
  39               --add-flags "\''${FIREJAIL_FLAGS:-}" \
  40               --add-flags "\''${FIREJAIL_FLAGS_${packageName}:-}" \
  41               --add-flags "${pkgs.lib.escapeShellArgs args}" \
  42               --add-flags "${package}/$path" \
  43               --inherit-argv0
  44           done
  45         '';
  46       }
  47     ) { };
  48 }