From 65e421bf17732b1b8a550e3c1185300a797ac151 Mon Sep 17 00:00:00 2001
From: aleksana <me@aleksana.moe>
Date: Thu, 18 Jan 2024 19:40:09 +0800
Subject: [PATCH] gnome-keyring: add option to use security wrapper provided by
 nixos

---
 modules/services/gnome-keyring.nix | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/modules/services/gnome-keyring.nix b/modules/services/gnome-keyring.nix
index 11f3107c..5d6d8ba3 100644
--- a/modules/services/gnome-keyring.nix
+++ b/modules/services/gnome-keyring.nix
@@ -13,6 +13,14 @@ in {
     services.gnome-keyring = {
       enable = mkEnableOption "GNOME Keyring";
 
+      useSecurityWrapper = mkEnableOption ''
+        using gnome-keyring-daemon wrapped by NixOS security wrapper
+        (i.e. {file}`/run/wrappers/bin/gnome-keyring-daemon`) with
+        `CAP_IPC_LOCK` to enhance memory security. This option will
+        only work on NixOS with system-wide
+        {option}`services.gnome.gnome-keyring.enable` option enabled
+      '';
+
       components = mkOption {
         type = types.listOf (types.enum [ "pkcs11" "secrets" "ssh" "gpg" ]);
         default = [ ];
@@ -49,7 +57,11 @@ in {
           args = concatStringsSep " " ([ "--start" "--foreground" ]
             ++ optional (cfg.components != [ ])
             ("--components=" + concatStringsSep "," cfg.components));
-        in "${pkgs.gnome.gnome-keyring}/bin/gnome-keyring-daemon ${args}";
+          executable = if cfg.useSecurityWrapper then
+            "/run/wrappers/bin/gnome-keyring-daemon"
+          else
+            "${pkgs.gnome.gnome-keyring}/bin/gnome-keyring-daemon";
+        in "${executable} ${args}";
         Restart = "on-abort";
       };