nixpkgs/overlays/firejail.nix

   1 { ... }:
   2 pkgs: _previousPkgs: {
   3   firejailWrap =
   4     {
   5       package,
   6       packageName ? package.meta.mainProgram or (pkgs.lib.getName package),
   7       paths ? [ "bin/${packageName}" ],
   8       name ? package.name + "-firejailed",
   9       args ? [ ],
  10       firejail ? "/run/wrappers/bin/firejail",
  11     }:
  12     let
  13       # Explanation(flexibility): in order to enable
  14       # tweaking the jail in a direnv or without a system rebuild
  15       # this wrapper allows changing firejail flags at runtime from envvars:
  16       # - overriding flags with: FIREJAIL_FLAGS_${packageNameEscaped}
  17       # - add extra flags with: FIREJAIL_EXTRAFLAGS_${packageNameEscaped}
  18       # When using --profile=foo, it's also possible to override
  19       # firejail's builtin profile in ~/.config/firejail/foo.profile
  20       # or modify it with ~/.config/firejail/foo.local
  21       packageNameEscaped = pkgs.lib.concatMapStrings (s: if builtins.isList s then "_" else s) (
  22         builtins.split "[^a-zA-Z0-9_]+" packageName
  23       );
  24     in
  25     pkgs.lib.makeOverridable (
  26       # Explanation(compatibility): if .override(overrideArgs) is used
  27       # on the wrapping package (eg. if used on programs.firefox.package),
  28       # overrideArgs is passed to the wrapped package.
  29       overrideArgs:
  30       # Explanation(perf/resource): using symlinkJoin instead of package.overrideAttrs
  31       # enables to get the wrapped package from the cache as usual.
  32       # The main drawback is that the user may have to inherit more attributes.
  33       # eg. programs.neovim.package = pkgs.firejailWrap { … } // { inherit (pkgs.neovim-unwrapped) lua; };
  34       pkgs.symlinkJoin {
  35         inherit name;
  36         meta = package.meta or { };
  37         passthru = package.passthru or { };
  38         paths = [ (package.override overrideArgs) ];
  39         nativeBuildInputs = [ pkgs.makeShellWrapper ];
  40         postBuild = pkgs.lib.concatStringsSep "\n" [
  41           # Explanation(compatibility): /run/wrappers/ is not yet available
  42           # hence disable that check in makeShellWrapper.
  43           ''
  44             assertExecutable () { true; }
  45           ''
  46           # Explanation(functional/correctness):
  47           # in case the wrapping package is called when building a derivation
  48           # (eg. in neovim: Generating remote plugin manifest)
  49           # /run/wrappers/ does not exist, hence just bypass firejail using a --run.
  50           #
  51           # Note that setting --argv0 would have no lasting effect because
  52           # nixos/modules/security/wrappers/wrapper.c forces argv[0] = SOURCE_PROG
  53           # Tip(tmux): #{pane_current_command} is thus always "firejail" in tmux,
  54           # but this can be worked around with something like:
  55           # set -g pane-border-format " #P: #{?#{==:#{pane_current_command},firejail},#{pane_title},#{pane_current_command}} "
  56           ''
  57             for path in ${pkgs.lib.escapeShellArgs paths}; do
  58               rm "$out/$path"
  59               makeShellWrapper \
  60                 ${firejail} \
  61                 "$out/$path" \
  62                 --run "[ -x ${firejail} ] || exec "${package}/$path" \"\$@\"" \
  63                 --add-flags "--name=${pkgs.lib.escapeShellArg packageName}" \
  64                 --add-flags "\''${FIREJAIL_FLAGS_${packageNameEscaped}-${pkgs.lib.escapeShellArgs args}}" \
  65                 --add-flags "\''${FIREJAIL_EXTRAFLAGS_${packageNameEscaped}:-}" \
  66                 --add-flags "${package}/$path"
  67             done
  68           ''
  69         ];
  70       }
  71     ) { };
  72 }