feature request: security.wrappers

[ezracelli]

NixOS has security.wrappers, a mechanism to enable certain security features (SUID/GUID, capabilities, ownership/permissions) without directly modifying the Nix store.

It’d be great to have this functionality in nix-darwin, too — I’d like to set the SUID bit on htop (it’s the only way to see info from all users’ processes without sudo).

NixOS module implementation: https://github.com/NixOS/nixpkgs/blob/nixos-unstable/nixos/modules/security/wrappers/default.nix

[LnL7]

Once upon a time I spent a little time on this, next to setuid on darwin there's also a usecase for codesinging certain binaries. Perhaps a008b2e could still be useful as a reference.