pkgs/sandbox: Add flag to bind-mount read-only

While the Nix store should be read-only by default, we can't guarantee
this as the Nix store could be mounted read-write (for example on
non-NixOS systems).

For paths other than store directories, I took a conservative approach
here where only /etc is mounted read-only, for all the pseudo-
filesystems such as /proc, /sys or /dev write access might still be
needed, for example to write to a hardware device exposed via /dev (eg.
a gamepad with rumble support).

Signed-off-by: aszlig <aszlig@nix.build>

0 files changed, 0 insertions, 0 deletions