diff options
author | Drew DeVault <[email protected]> | 2017-02-19 02:36:36 -0500 |
---|---|---|
committer | Drew DeVault <[email protected]> | 2017-02-19 02:56:59 -0500 |
commit | 7dbecdde95d1f309d8fdd02fe480dc3fbef7c7c1 (patch) | |
tree | 303b3632a576fac27835523872f8286adbd35d9b /security.d | |
parent | 76614efb16527420017291cd47de176b11440d38 (diff) |
Revise IPC security configuration
Diffstat (limited to 'security.d')
-rw-r--r-- | security.d/00-defaults.in | 47 |
1 files changed, 47 insertions, 0 deletions
diff --git a/security.d/00-defaults.in b/security.d/00-defaults.in new file mode 100644 index 00000000..99859edd --- /dev/null +++ b/security.d/00-defaults.in @@ -0,0 +1,47 @@ +# sway security rules +# +# Read sway-security(7) for details on how to secure your sway install. +# +# You MUST read this man page if you intend to attempt to secure your sway +# installation. +# +# This file should live at __SYSCONFDIR__/sway/security and will be +# automatically read by sway. + +# Configures enabled compositor features for specific programs +permit * fullscreen keyboard mouse +permit __PREFIX__/bin/swaylock lock +permit __PREFIX__/bin/swaybg background +permit __PREFIX__/bin/swaygrab screenshot +permit __PREFIX__/bin/swaybar panel + +# Configures enabled IPC features for specific programs +ipc __PREFIX__/bin/swaymsg { + * enabled + + events { + * disabled + } +} + +ipc __PREFIX__/bin/swaybar { + bar-config enabled + outputs enabled + workspaces enabled + command enabled +} + +ipc __PREFIX__/bin/swaygrab { + outputs enabled + tree enabled +} + +# Limits the contexts from which certain commands are permitted +commands { + * all + + fullscreen binding criteria + bindsym config + exit binding + kill binding +} |