--allow-dbus is meant to replace --allow-xdg-runtime for accessing the keyring, e.g. for gh CLI access because it stores the access token there. Unfortunately, giving access to the entire D-Bus and even the entire keyring is still grossly insecure.
Mature sandboxing systems use credential injection which in the Nix world translates to SecretSpec which also has a Keyring Provider.
Tasks:
- Provide a happy path towards extracting the
gh CLI authentication via SecretSpec
- Investigate making an agent-proxy that is built into the CLI but runs outside the sandbox
--allow-dbusis meant to replace--allow-xdg-runtimefor accessing the keyring, e.g. forghCLI access because it stores the access token there. Unfortunately, giving access to the entire D-Bus and even the entire keyring is still grossly insecure.Mature sandboxing systems use credential injection which in the Nix world translates to SecretSpec which also has a Keyring Provider.
Tasks:
ghCLI authentication via SecretSpec