Stuart Henderson wrote:
> On 2026/06/29 17:05, Chris Billington wrote:
>> browserpass-native provides a Native Messaging host for the 'pass' password
>> manager (security/password-store)
>>
>> It uses the 'browserpass' add-on for Firefox, Chromium and variants,
>> available via the usual add-on stores.
>>
>> pkg-readme file gives details on how to configure unveil.main for common
>> browsers.
>>
>> Version attached is 3.1.2 (9/2025, latest)
>> Minor patch was necessary to work with the latest pledge on 7.9
>>
>> Tested on 7.9-current Build date: 1782425853 - Thu Jun 25 22:17:33 UTC
>>
>> Testers and comments welcome. Happy to be Maintainer.
>>
>> Regards
>> Chris Billington
> 
> 
> : 1. In order to use browser integration you need to add the following unveil
> : rules:
> :
> : # for using the browserpass addon with the password-store package
> : ${LOCALBASE}/bin r
> : ${LOCALBASE}/bin/browserpass-native rx
> :
> : to the corresponding configuration file:
> : * Chromium -> ${SYSCONFDIR}/chromium/unveil.main
> : * Firefox -> ${SYSCONFDIR}/firefox/unveil.main
> : * Iridium -> ${SYSCONFDIR}/iridium/unveil.main
> : * Ungoogled-chromium -> ${SYSCONFDIR}/ungoogled-chromium/unveil.main
> 
> this is a total pain because now the user will have to manage the
> unveil files themselves and merge in any changes after updates to the
> browser ports. the pkg-readme would at least need to inform the user
> about this, but it would be better if these could be included in the
> relevant files directly in the browser ports (though 'r' for all of
> /usr/local/bin might be a bit much)...
> 

While I can't remove the need to modify the unveil.main file, it is 
possible to remove the need to expose the whole of ${LOCALBASE}/bin by 
the mod below, confining access to a single executable. This could also 
be applied to the existing keepassxc-browser port, for the same reasons.

"
...
In order to use browser integration without giving the browser read 
access via unveil(2) to the entire /usr/local/bin directory, it is 
necessary to copy the executable to a unique directory in ~/.local/bin 
and configure access.

$ mkdir -p ~/.local/bin/browserpass
$ cp /usr/local/bin/browserpass-native ~/.local/bin/browserpass

Then add the following unveil(2) rules to access it:

~/.local/bin/browserpass r
~/.local/bin//browserpass/browserpass-native rx

...

Note: As with all local adjustments to @sample files shipped with 
browser packages, pkg_add will warn that the package file(s) may have 
been updated.

Run 'sysmerge -p' after updating to merge such changes with your local 
copy."

Is this an improvement? The shipped xxx.json files can be patched to 
match, or manually edited as described in the README.

Regards
Chris