main
1# https://github.com/zno233/nixos-config/blob/319a4813e09af421beefa21146516fc1fb338e3f/pkgs/nixpaks/modules/common.nix
2{
3 pkgs,
4 lib,
5 config,
6 sloth,
7 ...
8}: let
9 inherit (config.flatpak) appId;
10in {
11 config = {
12 dbus = {
13 policies =
14 {
15 # dBus policy perms: `see` enumerates, `talk` sends/receives, `own` owns.
16
17 # === General ===
18 "${appId}" = "own";
19 "${appId}.*" = "own";
20 "org.freedesktop.DBus" = "talk";
21 "ca.desrt.dconf" = "talk";
22 "org.freedesktop.appearance" = "talk";
23 "org.freedesktop.appearance.*" = "talk";
24 "org.freedesktop.FileManager1" = "talk";
25 "org.freedesktop.Notifications" = "talk";
26 "com.canonical.AppMenu.Registrar" = "talk";
27 "org.gnome.Shell.Screencast" = "talk";
28
29 # === Portal ===
30 "org.freedesktop.portal.Documents" = "talk";
31 "org.freedesktop.portal.FileTransfer" = "talk";
32 "org.freedesktop.portal.FileTransfer.*" = "talk";
33 "org.freedesktop.portal.Notification" = "talk";
34 "org.freedesktop.portal.OpenURI" = "talk";
35 "org.freedesktop.portal.OpenURI.OpenFile" = "talk";
36 "org.freedesktop.portal.OpenURI.OpenURI" = "talk";
37 "org.freedesktop.portal.Print" = "talk";
38 "org.freedesktop.portal.Request" = "see";
39
40 # === MPRIS ===
41 "org.mpris.MediaPlayer2.${appId}" = "own";
42 "org.mpris.MediaPlayer2.${appId}.*" = "own";
43 "org.mpris.MediaPlayer2.${lib.lists.last (lib.strings.splitString "." appId)}" = "own";
44 "org.mpris.MediaPlayer2.${lib.lists.last (lib.strings.splitString "." appId)}.*" = "own";
45 }
46 # Tray icons register under their own small sandbox pid, so a low pid range covers them.
47 // (builtins.listToAttrs (
48 map (id: lib.nameValuePair "org.kde.StatusNotifierItem-${toString id}-1" "own") (
49 lib.lists.range 2 29
50 )
51 ))
52 // {
53 "org.kde.StatusNotifierWatcher" = "talk";
54 };
55
56 # 'call' rules permit specific method calls on D-Bus interfaces.
57 rules.call = {
58 "org.freedesktop.FileManager1" = ["*"];
59 "org.freedesktop.Notifications.*" = ["*"];
60 "org.freedesktop.portal.Documents" = ["*"];
61 "org.freedesktop.portal.FileTransfer" = ["*"];
62 "org.freedesktop.portal.FileTransfer.*" = ["*"];
63 "org.freedesktop.portal.Notification" = ["*"];
64 "org.freedesktop.portal.OpenURI" = ["*"];
65 "org.freedesktop.portal.OpenURI.OpenFile" = ["*"];
66 "org.freedesktop.portal.OpenURI.OpenURI" = ["*"];
67 "org.freedesktop.portal.Print" = ["*"];
68 "org.freedesktop.portal.Request" = ["*"];
69
70 "org.freedesktop.portal.Desktop" = [
71 "org.freedesktop.DBus.Properties.GetAll"
72 "org.freedesktop.DBus.Properties.Get@/org/freedesktop/portal/desktop"
73 "org.freedesktop.portal.Session.Close"
74 "org.freedesktop.portal.Settings.ReadAll"
75 "org.freedesktop.portal.Settings.Read"
76 "org.freedesktop.portal.Account.GetUserInformation"
77
78 "org.freedesktop.portal.NetworkMonitor"
79 "org.freedesktop.portal.NetworkMonitor.*"
80 "org.freedesktop.portal.ProxyResolver.Lookup"
81 "org.freedesktop.portal.ProxyResolver.Lookup.*"
82
83 "org.freedesktop.portal.ScreenCast"
84 "org.freedesktop.portal.ScreenCast.*"
85 "org.freedesktop.portal.Screenshot"
86 "org.freedesktop.portal.Screenshot.Screenshot"
87
88 "org.freedesktop.portal.Camera"
89 "org.freedesktop.portal.Camera.*"
90 "org.freedesktop.portal.Usb"
91 "org.freedesktop.portal.Usb.*"
92
93 "org.freedesktop.portal.RemoteDesktop"
94 "org.freedesktop.portal.RemoteDesktop.*"
95
96 "org.freedesktop.portal.Documents"
97 "org.freedesktop.portal.Documents.*"
98 "org.freedesktop.portal.FileChooser"
99 "org.freedesktop.portal.FileChooser.*"
100 "org.freedesktop.portal.FileTransfer"
101 "org.freedesktop.portal.FileTransfer.*"
102
103 "org.freedesktop.portal.Notification"
104 "org.freedesktop.portal.Notification.*"
105
106 "org.freedesktop.portal.Print"
107 "org.freedesktop.portal.Print.*"
108
109 "org.freedesktop.portal.OpenURI"
110 "org.freedesktop.portal.OpenURI.*"
111 "org.freedesktop.portal.Email.ComposeEmail"
112
113 "org.freedesktop.portal.Secret"
114 "org.freedesktop.portal.Secret.RetrieveSecret"
115
116 "org.freedesktop.portal.Inhibit"
117 "org.freedesktop.portal.Inhibit.*"
118
119 "org.freedesktop.portal.Request"
120 ];
121 };
122
123 # 'broadcast' rules permit receiving signals from D-Bus names.
124 rules.broadcast = {
125 "org.freedesktop.portal.*" = ["@/org/freedesktop/portal/*"];
126 };
127
128 args = [
129 "--filter"
130 "--sloppy-names"
131 "--log"
132 ];
133 };
134
135 locale.enable = lib.mkDefault true;
136
137 bubblewrap = {
138 network = lib.mkDefault false;
139
140 env.FLATPAK_ID = appId;
141
142 bind.rw = [
143 [(sloth.mkdir sloth.appDataDir) sloth.xdgDataHome]
144 [(sloth.mkdir sloth.appConfigDir) sloth.xdgConfigHome]
145 [(sloth.mkdir sloth.appCacheDir) sloth.xdgCacheHome]
146
147 (sloth.concat' sloth.runtimeDir "/doc") # For file chooser
148
149 (sloth.concat' sloth.runtimeDir "/dconf")
150 ];
151 bind.ro = [
152 (sloth.concat' sloth.xdgConfigHome "/dconf")
153 [(lib.getExe pkgs.bashInteractive) "/bin/sh"]
154
155 # /etc/localtime is a symlink into /etc/zoneinfo on NixOS
156 "/etc/localtime"
157 "/etc/zoneinfo"
158 ];
159 bind.dev = ["/dev/shm"];
160 tmpfs = ["/tmp"];
161 };
162 };
163}