lnl: sandbox fetch-nixpkgs-updates service

1 files changed, 7 insertions, 2 deletions

diff --git a/modules/examples/lnl.nix b/modules/examples/lnl.nix
index ba80e68..ebfbafb 100644
--- a/modules/examples/lnl.nix
+++ b/modules/examples/lnl.nix
@@ -60,8 +60,13 @@
   services.chunkwm.enable = true;
   services.skhd.enable = true;
 
-  launchd.user.agents.fetch-nixpkgs = {
-    command = "${pkgs.git}/bin/git -C /src/nixpkgs fetch origin master";
+  security.sandbox.profiles.fetch-nixpkgs-updates.closure = [ pkgs.cacert pkgs.git ];
+  security.sandbox.profiles.fetch-nixpkgs-updates.writablePaths = [ "/src/nixpkgs" ];
+  security.sandbox.profiles.fetch-nixpkgs-updates.allowNetworking = true;
+
+  launchd.user.agents.fetch-nixpkgs-updates = {
+    command = "/usr/bin/sandbox-exec -f ${config.security.sandbox.profiles.fetch-nixpkgs-updates.profile} ${pkgs.git}/bin/git -C /src/nixpkgs fetch origin master";
+    environment.HOME = "";
     environment.SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
     serviceConfig.KeepAlive = false;
     serviceConfig.ProcessType = "Background";