nix: remove portal paths from default

Despite presenting itself as a generic desktop integration interface, xdg-desktop portal is highly flatpak-centric and only supports flatpak and snap in practice. It is a significant attack surface to begin with as it is a privileged process which accepts input from unprivileged processes, and the lack of support for anything other than fortify also introduces various information leaks when exposed to fortify as it treats fortified programs as unsandboxed, privileged programs in many cases. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-10 22:24:17 +09:00 · 2024-11-10 22:24:17 +09:00 · 1a09b55bd4
parent 9a13b311ac
commit 1a09b55bd4
1 changed files with 2 additions and 6 deletions
--- a/nixos.nix
+++ b/nixos.nix
@ -282,12 +282,8 @@ in
                        "org.mpris.MediaPlayer2.${id}.*"
                      ])
                      ++ ext.own;
-                    call = {
-                      "org.freedesktop.portal.*" = "*";
-                    } // ext.call;
-                    broadcast = {
-                      "org.freedesktop.portal.*" = "@/org/freedesktop/portal/*";
-                    } // ext.broadcast;
+
+                    inherit (ext) call broadcast;
                  };
                  dbusConfig =
                    let