Extend device support

lib/sandbox.nim

@@ -39,6 +39,11 @@ proc sandboxExec*(args: Args) =
     .addArg("--dev", "/dev")
     .addMount("--dev-bind", "/dev/random")
     .addMount("--dev-bind", "/dev/urandom")
+    .addMount("--ro-bind", "/sys/block")
+    .addMount("--ro-bind", "/sys/bus")
+    .addMount("--ro-bind", "/sys/class")
+    .addMount("--ro-bind", "/sys/dev")
+    .addMount("--ro-bind", "/sys/devices")
     .addArg("--tmpfs", "/tmp")
     .addArg("--tmpfs", "/dev/shm")
     .addArg("--proc", "/proc")
@@ -48,6 +53,10 @@ proc sandboxExec*(args: Args) =
     .addArg("--setenv", "BWSANDBOX", "1")
     .applyConfig(config)
 
+  if config.sethostname.get(false):
+    call
+      .addArg("--hostname", hostname)
+
   if config.dbus.get(false):
     # todo: handle process and cleanup later
     let proxy = startDBusProxy(config, hostname)
@@ -60,13 +69,4 @@ proc sandboxExec*(args: Args) =
   if config.allowdri.get(false):
     enableDri(call)
 
-  if config.mountcwd.get(false):
-    call
-      .addMount("--bind", getCurrentDir())
-      .addArg("--chdir", getCurrentDir())
-
-  if config.sethostname.get(false):
-    call
-      .addArg("--hostname", hostname)
-
-  call.addArg(args.getCmd).exec()
+  call.addArg(args.getCmd).exec()