permissions: add plugin perms

pages/Configuring/Permissions.md

@@ -52,6 +52,9 @@ There are 3 modes:
  - If denied, will render a black screen with a "permission denied" text.
  - Why deny? For apps / scripts that might maliciously try to capture your screen without your knowledge by using wayland protocols directly.
 
+`plugin`:
+ - Access to load a plugin. Can be either a regex for the app binary, or plugin path.
+ - Do _not_ allow `hyprctl` to load your plugins by default (attacker could issue `hyprctl plugin load /tmp/my-malicious-plugin.so`)
 
 ## Notes
 

pages/Plugins/Using-Plugins.md

@@ -34,7 +34,22 @@ manual instructions, see [here](#manual).
 
 ### hyprpm
 
-Make sure you have the required dependencies: `cpio`, `cmake`.
+{{< callout type=info >}}
+
+If you are using [permission management](../Configuring/Permissions.md),
+you should allow hyprpm to load plugins by adding this to your config:
+
+```ini
+permission = /usr/(bin|local/bin)/hyprpm, plugin, allow
+```
+
+otherwise you'll get a popup asking for permission every time hyprpm tries to load a plugin.
+
+{{< /callout >}}
+
+Make sure you have the required dependencies: `cpio`, `cmake`, `git`, `meson` and `gcc`.
+You might also need `-dev` packages of Hyprland's dependencies if your distro splits
+binaries and headers (e.g. Fedora or Debian). 
 
 Find a repository you want to install plugins from. As an example, we will use
 [hyprland-plugins](https://github.com/hyprwm/hyprland-plugins).