Add new bwrap scripts

bwrap/icedove-uxp-private.bash

@@ -0,0 +1,44 @@
+#!/bin/bash
+
+set -euo pipefail
+
+(exec bwrap \
+      --proc /proc \
+      --dev /dev \
+      --tmpfs /tmp \
+      --dev-bind /dev/dri /dev/dri \
+      --ro-bind /etc/fonts /etc/fonts \
+      --ro-bind /etc/ssl/certs /etc/ssl/certs \
+      --ro-bind /etc/resolv.conf /etc/resolv.conf \
+      --ro-bind /lib /lib \
+      --ro-bind /lib64 /lib64 \
+      --ro-bind /sys/dev/char /sys/dev/char \
+      --ro-bind /usr/bin /usr/bin \
+      --ro-bind /usr/include/fontconfig /usr/include/fontconfig \
+      --ro-bind /usr/lib /usr/lib \
+      --ro-bind /usr/lib64 /usr/lib64 \
+      --ro-bind /usr/share/applications /usr/share/applications \
+      --ro-bind /usr/share/ca-certificates /usr/share/ca-certificates \
+      --ro-bind /usr/share/fonts /usr/share/fonts \
+      --ro-bind /usr/share/glib-2.0 /usr/share/glib-2.0 \
+      --ro-bind /usr/share/icons /usr/share/icons \
+      --ro-bind /usr/share/libdrm /usr/share/libdrm \
+      --ro-bind /usr/share/mime /usr/share/mime \
+      --ro-bind /usr/share/X11/xkb /usr/share/X11/xkb \
+      --ro-bind /var/cache/fontconfig /var/cache/fontconfig \
+      --ro-bind "${HOME}/.Xauthority" "${HOME}/.Xauthority" \
+      --chdir "${HOME}" \
+      --unshare-all \
+      --share-net \
+      --die-with-parent \
+      --hostname RESTRICTED \
+      --setenv SHELL /bin/false \
+      --setenv PATH /usr/bin \
+      --file 11 /etc/passwd \
+      --file 12 /etc/group \
+      --new-session \
+      /usr/bin/icedove-uxp) \
+    11< <(getent passwd $UID 65534) \
+    12< <(getent group "$(id -g)" 65534)
+
+# note: running icedove-uxp on private mode sanbox

bwrap/icedove-uxp.bash

@@ -0,0 +1,52 @@
+#!/bin/bash
+
+set -euo pipefail
+
+(exec bwrap \
+      --proc /proc \
+      --dev /dev \
+      --tmpfs /tmp \
+      --dev-bind /dev/dri /dev/dri \
+      --ro-bind /etc/fonts/ /etc/fonts/ \
+      --ro-bind /etc/ssl/certs /etc/ssl/certs \
+      --ro-bind /etc/resolv.conf /etc/resolv.conf \
+      --ro-bind /lib /lib \
+      --ro-bind /lib64 /lib64 \
+      --ro-bind /sys/dev/char /sys/dev/char \
+      --ro-bind /usr/bin /usr/bin \
+      --ro-bind /usr/include/fontconfig /usr/include/fontconfig \
+      --ro-bind /usr/lib /usr/lib \
+      --ro-bind /usr/lib64 /usr/lib64 \
+      --ro-bind /usr/share/applications /usr/share/applications \
+      --ro-bind /usr/share/ca-certificates /usr/share/ca-certificates \
+      --ro-bind /usr/share/fonts /usr/share/fonts \
+      --ro-bind /usr/share/glib-2.0 /usr/share/glib-2.0 \
+      --ro-bind /usr/share/icons /usr/share/icons \
+      --ro-bind /usr/share/libdrm /usr/share/libdrm \
+      --ro-bind /usr/share/mime /usr/share/mime \
+      --ro-bind /usr/share/X11/xkb /usr/share/X11/xkb \
+      --ro-bind /var/cache/fontconfig /var/cache/fontconfig \
+      --ro-bind "${HOME}/.Xauthority" "${HOME}/.Xauthority" \
+      --bind "${HOME}/.cache/hyperbola" "${HOME}/.cache/hyperbola" \
+      --bind "${HOME}/.hyperbola" "${HOME}/.hyperbola" \
+      --bind "${HOME}/.config/gtk-2.0" "${HOME}/.config/gtk-2.0" \
+      --bind "${HOME}/.gtkrc-2.0" "${HOME}/.gtkrc-2.0" \
+      --bind "${HOME}/.icons" "${HOME}/.icons" \
+      --bind "${HOME}/.local/share/fonts" "${HOME}/.local/share/fonts" \
+      --bind "${HOME}/.themes" "${HOME}/.themes" \
+      --bind "${HOME}/Descargas" "${HOME}/Descargas" \
+      --chdir "${HOME}" \
+      --unshare-all \
+      --share-net \
+      --die-with-parent \
+      --hostname RESTRICTED \
+      --setenv SHELL /bin/false \
+      --setenv PATH /usr/bin \
+      --file 11 /etc/passwd \
+      --file 12 /etc/group \
+      --new-session \
+      /usr/bin/icedove-uxp) \
+    11< <(getent passwd $UID 65534) \
+    12< <(getent group "$(id -g)" 65534)
+
+# note: running icedove-uxp mode sanbox

config

@@ -307,8 +307,8 @@ set $mode_apps Launch: Shift enable mode private apps [i]ceweasel-uxp ice[d]ove-
 mode "$mode_apps" {
     bindsym i exec "bash $HOME/.config/bwrap/iceweasel-uxp.bash", mode "default"
     bindsym Shift+i exec "bash $HOME/.config/bwrap/iceweasel-uxp-private.bash", mode "default"
-    bindsym d exec "firejail --seccomp --noroot --disable-mnt icedove-uxp", mode "default"
+    bindsym d exec "bash $HOME/.config/bwrap/icedove-uxp.bash", mode "default"
-    bindsym Shift+d exec "firejail --seccomp --private icedove-uxp", mode "default"
+    bindsym Shift+d exec "bash $HOME/.config/bwrap/icedove-uxp-private.bash", mode "default"
     # back to normal: Enter or Escape
     bindsym Return mode "default"
     bindsym Escape mode "default"