From 585f7de3fb7110b57c6e78f02242a8a5c7a855d1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jes=C3=BAs?= <heckyel@hyperbola.info>
Date: Fri, 1 Oct 2021 12:31:12 -0500
Subject: [PATCH] Add new bwrap scripts

---
 bwrap/icedove-uxp-private.bash | 44 ++++++++++++++++++++++++++++
 bwrap/icedove-uxp.bash         | 52 ++++++++++++++++++++++++++++++++++
 config                         |  4 +--
 3 files changed, 98 insertions(+), 2 deletions(-)
 create mode 100644 bwrap/icedove-uxp-private.bash
 create mode 100644 bwrap/icedove-uxp.bash

diff --git a/bwrap/icedove-uxp-private.bash b/bwrap/icedove-uxp-private.bash
new file mode 100644
index 0000000..6f1af33
--- /dev/null
+++ b/bwrap/icedove-uxp-private.bash
@@ -0,0 +1,44 @@
+#!/bin/bash
+
+set -euo pipefail
+
+(exec bwrap \
+      --proc /proc \
+      --dev /dev \
+      --tmpfs /tmp \
+      --dev-bind /dev/dri /dev/dri \
+      --ro-bind /etc/fonts /etc/fonts \
+      --ro-bind /etc/ssl/certs /etc/ssl/certs \
+      --ro-bind /etc/resolv.conf /etc/resolv.conf \
+      --ro-bind /lib /lib \
+      --ro-bind /lib64 /lib64 \
+      --ro-bind /sys/dev/char /sys/dev/char \
+      --ro-bind /usr/bin /usr/bin \
+      --ro-bind /usr/include/fontconfig /usr/include/fontconfig \
+      --ro-bind /usr/lib /usr/lib \
+      --ro-bind /usr/lib64 /usr/lib64 \
+      --ro-bind /usr/share/applications /usr/share/applications \
+      --ro-bind /usr/share/ca-certificates /usr/share/ca-certificates \
+      --ro-bind /usr/share/fonts /usr/share/fonts \
+      --ro-bind /usr/share/glib-2.0 /usr/share/glib-2.0 \
+      --ro-bind /usr/share/icons /usr/share/icons \
+      --ro-bind /usr/share/libdrm /usr/share/libdrm \
+      --ro-bind /usr/share/mime /usr/share/mime \
+      --ro-bind /usr/share/X11/xkb /usr/share/X11/xkb \
+      --ro-bind /var/cache/fontconfig /var/cache/fontconfig \
+      --ro-bind "${HOME}/.Xauthority" "${HOME}/.Xauthority" \
+      --chdir "${HOME}" \
+      --unshare-all \
+      --share-net \
+      --die-with-parent \
+      --hostname RESTRICTED \
+      --setenv SHELL /bin/false \
+      --setenv PATH /usr/bin \
+      --file 11 /etc/passwd \
+      --file 12 /etc/group \
+      --new-session \
+      /usr/bin/icedove-uxp) \
+    11< <(getent passwd $UID 65534) \
+    12< <(getent group "$(id -g)" 65534)
+
+# note: running icedove-uxp on private mode sanbox
diff --git a/bwrap/icedove-uxp.bash b/bwrap/icedove-uxp.bash
new file mode 100644
index 0000000..72247be
--- /dev/null
+++ b/bwrap/icedove-uxp.bash
@@ -0,0 +1,52 @@
+#!/bin/bash
+
+set -euo pipefail
+
+(exec bwrap \
+      --proc /proc \
+      --dev /dev \
+      --tmpfs /tmp \
+      --dev-bind /dev/dri /dev/dri \
+      --ro-bind /etc/fonts/ /etc/fonts/ \
+      --ro-bind /etc/ssl/certs /etc/ssl/certs \
+      --ro-bind /etc/resolv.conf /etc/resolv.conf \
+      --ro-bind /lib /lib \
+      --ro-bind /lib64 /lib64 \
+      --ro-bind /sys/dev/char /sys/dev/char \
+      --ro-bind /usr/bin /usr/bin \
+      --ro-bind /usr/include/fontconfig /usr/include/fontconfig \
+      --ro-bind /usr/lib /usr/lib \
+      --ro-bind /usr/lib64 /usr/lib64 \
+      --ro-bind /usr/share/applications /usr/share/applications \
+      --ro-bind /usr/share/ca-certificates /usr/share/ca-certificates \
+      --ro-bind /usr/share/fonts /usr/share/fonts \
+      --ro-bind /usr/share/glib-2.0 /usr/share/glib-2.0 \
+      --ro-bind /usr/share/icons /usr/share/icons \
+      --ro-bind /usr/share/libdrm /usr/share/libdrm \
+      --ro-bind /usr/share/mime /usr/share/mime \
+      --ro-bind /usr/share/X11/xkb /usr/share/X11/xkb \
+      --ro-bind /var/cache/fontconfig /var/cache/fontconfig \
+      --ro-bind "${HOME}/.Xauthority" "${HOME}/.Xauthority" \
+      --bind "${HOME}/.cache/hyperbola" "${HOME}/.cache/hyperbola" \
+      --bind "${HOME}/.hyperbola" "${HOME}/.hyperbola" \
+      --bind "${HOME}/.config/gtk-2.0" "${HOME}/.config/gtk-2.0" \
+      --bind "${HOME}/.gtkrc-2.0" "${HOME}/.gtkrc-2.0" \
+      --bind "${HOME}/.icons" "${HOME}/.icons" \
+      --bind "${HOME}/.local/share/fonts" "${HOME}/.local/share/fonts" \
+      --bind "${HOME}/.themes" "${HOME}/.themes" \
+      --bind "${HOME}/Descargas" "${HOME}/Descargas" \
+      --chdir "${HOME}" \
+      --unshare-all \
+      --share-net \
+      --die-with-parent \
+      --hostname RESTRICTED \
+      --setenv SHELL /bin/false \
+      --setenv PATH /usr/bin \
+      --file 11 /etc/passwd \
+      --file 12 /etc/group \
+      --new-session \
+      /usr/bin/icedove-uxp) \
+    11< <(getent passwd $UID 65534) \
+    12< <(getent group "$(id -g)" 65534)
+
+# note: running icedove-uxp mode sanbox
diff --git a/config b/config
index 660d55e..cd08be6 100644
--- a/config
+++ b/config
@@ -307,8 +307,8 @@ set $mode_apps Launch: Shift enable mode private apps [i]ceweasel-uxp ice[d]ove-
 mode "$mode_apps" {
     bindsym i exec "bash $HOME/.config/bwrap/iceweasel-uxp.bash", mode "default"
     bindsym Shift+i exec "bash $HOME/.config/bwrap/iceweasel-uxp-private.bash", mode "default"
-    bindsym d exec "firejail --seccomp --noroot --disable-mnt icedove-uxp", mode "default"
-    bindsym Shift+d exec "firejail --seccomp --private icedove-uxp", mode "default"
+    bindsym d exec "bash $HOME/.config/bwrap/icedove-uxp.bash", mode "default"
+    bindsym Shift+d exec "bash $HOME/.config/bwrap/icedove-uxp-private.bash", mode "default"
     # back to normal: Enter or Escape
     bindsym Return mode "default"
     bindsym Escape mode "default"