Permissions
Choose which programs may capture the screen, inject input, or read the clipboard
By default every program you run can capture the screen, read the clipboard, and send fake input. Permissions let you limit that to the programs you name.
sweets.permissions({ enforce = true })
-- Screen sharing goes through the portal. Allow it first.
sweets.permission({
program = "/usr/lib/xdg-desktop-portal-wlr",
protocol = "screencopy",
mode = "allow",
})
sweets.permission({ program = "/usr/bin/grim", protocol = "screencopy", mode = "allow" })
sweets.permission({ program = "/usr/bin/wl-paste", protocol = "data_control", mode = "allow" })Allow your screen-sharing portal before you turn on enforce. Without a rule,
screen sharing stops working in every application.
sweets.permissions
| Field | Type | Default | Effect |
|---|---|---|---|
enforce | boolean | false | Apply the permission rules |
While enforce is off, the rules are ignored and every program keeps full
access.
With enforce = true, anything no rule allows is denied. An empty rule list
denies every program everything below.
sweets.permission
Each call adds one rule. All three fields are required.
| Field | Type | Effect |
|---|---|---|
program | string or pattern | The program's full executable path |
protocol | string or list | One or more of the groups below |
mode | string | "allow" or "deny" |
A bare string must match the path exactly. A pattern table takes one of
exact, prefix, suffix, or contains, as in
window rules.
-- Every program under /usr/bin may use virtual input, except one.
sweets.permission({ program = { prefix = "/usr/bin/" }, protocol = "virtual_input", mode = "allow" })
sweets.permission({ program = "/usr/bin/wtype", protocol = "virtual_input", mode = "deny" })For each group, the last matching rule wins.
| Protocol | Covers | Used by |
|---|---|---|
screencopy | Screen and window capture | grim, xdg-desktop-portal-wlr, wf-recorder |
virtual_input | Virtual pointer and keyboard | wtype, wlrctl |
data_control | Clipboard access from outside a window | wl-copy, wl-paste, clipboard managers |
gamma_control | Screen colour temperature | gammastep |
output_management | Monitor layout changes | wlr-randr, wlrctl |
A denied program simply does not see the protocol. Most tools then report that the compositor does not support it.
Finding a program's path
Sweets logs each denial once when the program connects:
grep "permission policy" ~/.local/state/sweets/sweets.logThe program= field shows the exact path to put in a rule.
Limits
- Changes need a restart. A reload never changes the active permissions. It logs a warning if your file no longer matches them.
- If your configuration fails to load at startup, permissions are not enforced for that session.
- A script is identified by its interpreter, such as
/usr/bin/python3. - Programs in containers may report a path from inside the container.
This reduces accidental exposure. It is not a confidentiality guarantee. A program you can run can also be copied or started under an allowed path.
Sandboxed apps that use a security context, such as Flatpak apps, are always denied these protocols. A permission rule cannot allow them.