11 lines
519 B
Plaintext
11 lines
519 B
Plaintext
# Qubes OS qrexec policy for nsigner
|
|
# Syntax: service +argument source target action
|
|
#
|
|
# The ai qube is allowed without a dom0 popup (memory isolation is the
|
|
# real security boundary — the signer's own approval prompt in the
|
|
# nostr_signer terminal is the operation-level gate).
|
|
qubes.NsignerRpc * ai @tag:nsigner-signer allow target=nostr_signer
|
|
# Any other qube must get a dom0 confirmation popup.
|
|
qubes.NsignerRpc * @anyvm @tag:nsigner-signer ask default_target=nostr_signer
|
|
qubes.NsignerRpc * @anyvm @anyvm deny
|