Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

xdg-autostart: Add readOnly option #6629

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

olmokramer
Copy link
Contributor

@olmokramer olmokramer commented Mar 14, 2025

Description

Some programs add a .desktop file to XDG_CONFIG_HOME/autostart when they are started (can't remember from the top of my head which program did for me, and I've already deleted the file), but I want to be able to explicitly grant programs permission to autostart in my home manager configuration. This PR adds a xdg.autostart.readOnly option to make that possible.

When readOnly is set to true the autostart entries are linked from a readonly directory in the nix store and XDG_CONFIG_HOME/autostart is a link to that directory, so that programs cannot install arbitrary autostart services.

I haven't added a test yet because I first wanted to check whether this has a chance of being merged and if we really need the readOnly option, or if we should just always make XDG_CONFIG_HOME/autostart readonly, because something similar was done without an option for backwards compatibility in #5553.

Checklist

  • Change is backwards compatible.

  • Code formatted with ./format.

  • Code tested through nix-shell --pure tests -A run.all
    or nix build --reference-lock-file flake.lock ./tests#test-all using Flakes.

  • Test cases updated/added. See example.

  • Commit messages are formatted like

    {component}: {description}
    
    {long description}
    

    See CONTRIBUTING for more information and recent commit messages for examples.

  • If this PR adds a new module

    • Added myself as module maintainer. See example.

Maintainer CC @Scrumplex

When `readOnly` is set to `true` the autostart entries are linked from
a readonly directory in the nix store and `XDG_CONFIG_HOME/autostart` is
a link to that directory, so that programs cannot install arbitrary
autostart services.
Comment on lines +54 to +57
xdg.configFile = if cfg.readOnly then {
autostart.source = linkedDesktopEntries;
} else
listToAttrs (map mapDesktopEntry cfg.entries);
Copy link
Member

@Scrumplex Scrumplex Mar 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using the recursive option for HM's file options would be cleaner, I think. Recursive = true would link all files inside source recursively, whereas recursive = false would link autostart directly to source.

This also allows us to remove mapDesktopEntry above.

Suggested change
xdg.configFile = if cfg.readOnly then {
autostart.source = linkedDesktopEntries;
} else
listToAttrs (map mapDesktopEntry cfg.entries);
xdg.configFile."autostart" = {
recursive = !cfg.readOnly;
source = linkedDesktopEntries;
};

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants