# Some way to achieve opt-out (as opposed to opt-in) app sandboxing

**URL:** https://discourse.nixos.org/t/some-way-to-achieve-opt-out-as-opposed-to-opt-in-app-sandboxing/33661
**Category:** Help
**Created:** [September 29, 2023, 7:28pm UTC](https://discourse.nixos.org/t/some-way-to-achieve-opt-out-as-opposed-to-opt-in-app-sandboxing/33661 "2023-09-29T19:28:03Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![tmarkov](https://discourse.nixos.org/letter_avatar_proxy/v4/letter/t/df705f/32.png) [@tmarkov](https://discourse.nixos.org/u/tmarkov)
#### Post date: [September 29, 2023, 7:28pm UTC](https://discourse.nixos.org/t/some-way-to-achieve-opt-out-as-opposed-to-opt-in-app-sandboxing/33661/1 "2023-09-29T19:28:04Z")

</div>

Recently I was looking at [this thread](https://discourse.nixos.org/t/sandboxing-all-programs-by-default/7792), which has a lot of sandboxing approaches, both in general, as well as for NixOS. There’s also

- `programs.firejail.wrappedBinaries`
- [nixpak](https://github.com/nixpak/nixpak)
- and it wouldn’t be particularly hard to write my own `nix` function which takes in a `nix` package and returns a sandboxed version.

However, all those approaches are opt-in, which is not the best security practice. I would probably forget to specify `services.name.package` for some service and leave it with the unsandboxed default. Or, I’d forget to enter a sandbox before opening a directory with `.envrc` and `direnv` will add a bunch of unsandboxed things to the path.

I’m looking for some way to achieve a sandbox-by-default in NixOS, where I’d explicitly specify when some app actually needs full permissions.

In particular, I’d like things added to `$PATH`, or things run by services/modules to be sandboxed. However, if a package `foo` has `pkgs.bar` as a dependency and executes `${pkgs.bar}/bin/bar`, `pkgs.bar` should be in the store unsandbox, and will run in `foo`’s sandbox.