nix-community/home-manager
1
0
Fork 0
mirror of https://github.com/nix-community/home-manager.git synced 2025-12-06 00:51:04 +01:00
Code Activity

xdg-autostart: Add readOnly option (#6629)

Browse source 
When `readOnly` is set to `true` the autostart entries are linked from
a readonly directory in the nix store and `XDG_CONFIG_HOME/autostart` is
a link to that directory, so that programs cannot install arbitrary
autostart services.
This commit is contained in:
Olmo Kramer 2025-03-30 18:22:16 +02:00 • committed by GitHub
parent 1d2ed9c503
commit 09280e17bb
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 64 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

31
modules/misc/xdg-autostart.nix
View file

@ -1,25 +1,31 @@
{ config, lib, ... }:
{ config, lib, pkgs, ... }:
let
inherit (builtins) baseNameOf listToAttrs map unsafeDiscardStringContext;
inherit (lib) literalExpression mkEnableOption mkIf mkOption types;
cfg = config.xdg.autostart;
/* "/nix/store/x-foo/application.desktop" -> {
name = "autostart/application.desktop";
value = { source = "/nix/store/x-foo/application.desktop"; };
}
*/
mapDesktopEntry = entry: {
name = "autostart/${unsafeDiscardStringContext (baseNameOf entry)}";
value.source = entry;
};
linkedDesktopEntries = pkgs.runCommandNoCCLocal "xdg-autostart-entries" { } ''
mkdir -p $out
${lib.concatMapStringsSep "\n" (e: "ln -s ${e} $out") cfg.entries}
'';
in {
meta.maintainers = with lib.maintainers; [ Scrumplex ];
options.xdg.autostart = {
enable = mkEnableOption "creation of XDG autostart entries";
readOnly = mkOption {
type = lib.types.bool;
description = ''
Make `XDG_CONFIG_HOME/autostart` a symlink to a readonly directory so that
programs cannot install arbitrary autostart services.
'';
default = false;
example = true;
};
entries = mkOption {
type = with types; listOf path;
description = ''
@ -35,6 +41,9 @@ in {
};
config = mkIf (cfg.enable && cfg.entries != [ ]) {
xdg.configFile = listToAttrs (map mapDesktopEntry cfg.entries);
xdg.configFile.autostart = {
source = linkedDesktopEntries;
recursive = !cfg.readOnly;
};
};
}