security: add option to configure accessibilityPrograms

default.nix

@@ -35,6 +35,7 @@ let
         ./modules/nix/nixpkgs.nix
         ./modules/environment
         ./modules/launchd
+        ./modules/security
         ./modules/services/activate-system.nix
         ./modules/services/khd.nix
         ./modules/services/kwm.nix

modules/security/default.nix

@@ -0,0 +1,36 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  cfg = config.security;
+
+  runSQL = sql: ''/usr/bin/sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db "${sql}"'';
+
+  allowAccess = client: runSQL ''INSERT or REPLACE INTO access VALUES ('kTCCServiceAccessibility','${client}',1,1,1,NULL,NULL)'';
+  revokeAccess = clients: runSQL ''DELETE FROM access WHERE client LIKE '/nix/store/%' AND client NOT IN (${concatMapStringsSep "," (s: "'${s}'") clients})'';
+
+in
+
+{
+  options = {
+    security.accessibilityPrograms = mkOption {
+      type = types.listOf types.path;
+      default = [];
+      description = "List of nix programs that are allowed control through the accessibility APIs.";
+    };
+  };
+
+  config = {
+
+    system.activationScripts.accessibility.text = ''
+      # Set up programs that require accessibility permissions
+      echo "setting up accessibility programs..." >&2
+
+      ${revokeAccess cfg.accessibilityPrograms}
+      ${concatMapStringsSep "\n" allowAccess cfg.accessibilityPrograms}
+    '';
+
+  };
+}

modules/system/activation-scripts.nix

@@ -55,6 +55,7 @@ in
       ${cfg.activationScripts.nix-daemon.text}
       ${cfg.activationScripts.nix.text}
 
+      ${cfg.activationScripts.accessibility.text}
       ${cfg.activationScripts.etc.text}
       ${cfg.activationScripts.launchd.text}
       ${cfg.activationScripts.time.text}