heckyel/i3-config
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add new bwrap scripts

Browse Source
This commit is contained in:
Jesús 2021-10-01 12:31:12 -05:00
parent c902f9f6d1
commit 585f7de3fb
No known key found for this signature in database
GPG Key ID: F6EE7BC59A315766
3 changed files with 98 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
bwrap/icedove-uxp-private.bash Normal file
View File

@ -0,0 +1,44 @@
#!/bin/bash
set -euo pipefail
(exec bwrap \
--proc /proc \
--dev /dev \
--tmpfs /tmp \
--dev-bind /dev/dri /dev/dri \
--ro-bind /etc/fonts /etc/fonts \
--ro-bind /etc/ssl/certs /etc/ssl/certs \
--ro-bind /etc/resolv.conf /etc/resolv.conf \
--ro-bind /lib /lib \
--ro-bind /lib64 /lib64 \
--ro-bind /sys/dev/char /sys/dev/char \
--ro-bind /usr/bin /usr/bin \
--ro-bind /usr/include/fontconfig /usr/include/fontconfig \
--ro-bind /usr/lib /usr/lib \
--ro-bind /usr/lib64 /usr/lib64 \
--ro-bind /usr/share/applications /usr/share/applications \
--ro-bind /usr/share/ca-certificates /usr/share/ca-certificates \
--ro-bind /usr/share/fonts /usr/share/fonts \
--ro-bind /usr/share/glib-2.0 /usr/share/glib-2.0 \
--ro-bind /usr/share/icons /usr/share/icons \
--ro-bind /usr/share/libdrm /usr/share/libdrm \
--ro-bind /usr/share/mime /usr/share/mime \
--ro-bind /usr/share/X11/xkb /usr/share/X11/xkb \
--ro-bind /var/cache/fontconfig /var/cache/fontconfig \
--ro-bind "${HOME}/.Xauthority" "${HOME}/.Xauthority" \
--chdir "${HOME}" \
--unshare-all \
--share-net \
--die-with-parent \
--hostname RESTRICTED \
--setenv SHELL /bin/false \
--setenv PATH /usr/bin \
--file 11 /etc/passwd \
--file 12 /etc/group \
--new-session \
/usr/bin/icedove-uxp) \
11< <(getent passwd $UID 65534) \
12< <(getent group "$(id -g)" 65534)
# note: running icedove-uxp on private mode sanbox

52
bwrap/icedove-uxp.bash Normal file
View File

@ -0,0 +1,52 @@
#!/bin/bash
set -euo pipefail
(exec bwrap \
--proc /proc \
--dev /dev \
--tmpfs /tmp \
--dev-bind /dev/dri /dev/dri \
--ro-bind /etc/fonts/ /etc/fonts/ \
--ro-bind /etc/ssl/certs /etc/ssl/certs \
--ro-bind /etc/resolv.conf /etc/resolv.conf \
--ro-bind /lib /lib \
--ro-bind /lib64 /lib64 \
--ro-bind /sys/dev/char /sys/dev/char \
--ro-bind /usr/bin /usr/bin \
--ro-bind /usr/include/fontconfig /usr/include/fontconfig \
--ro-bind /usr/lib /usr/lib \
--ro-bind /usr/lib64 /usr/lib64 \
--ro-bind /usr/share/applications /usr/share/applications \
--ro-bind /usr/share/ca-certificates /usr/share/ca-certificates \
--ro-bind /usr/share/fonts /usr/share/fonts \
--ro-bind /usr/share/glib-2.0 /usr/share/glib-2.0 \
--ro-bind /usr/share/icons /usr/share/icons \
--ro-bind /usr/share/libdrm /usr/share/libdrm \
--ro-bind /usr/share/mime /usr/share/mime \
--ro-bind /usr/share/X11/xkb /usr/share/X11/xkb \
--ro-bind /var/cache/fontconfig /var/cache/fontconfig \
--ro-bind "${HOME}/.Xauthority" "${HOME}/.Xauthority" \
--bind "${HOME}/.cache/hyperbola" "${HOME}/.cache/hyperbola" \
--bind "${HOME}/.hyperbola" "${HOME}/.hyperbola" \
--bind "${HOME}/.config/gtk-2.0" "${HOME}/.config/gtk-2.0" \
--bind "${HOME}/.gtkrc-2.0" "${HOME}/.gtkrc-2.0" \
--bind "${HOME}/.icons" "${HOME}/.icons" \
--bind "${HOME}/.local/share/fonts" "${HOME}/.local/share/fonts" \
--bind "${HOME}/.themes" "${HOME}/.themes" \
--bind "${HOME}/Descargas" "${HOME}/Descargas" \
--chdir "${HOME}" \
--unshare-all \
--share-net \
--die-with-parent \
--hostname RESTRICTED \
--setenv SHELL /bin/false \
--setenv PATH /usr/bin \
--file 11 /etc/passwd \
--file 12 /etc/group \
--new-session \
/usr/bin/icedove-uxp) \
11< <(getent passwd $UID 65534) \
12< <(getent group "$(id -g)" 65534)
# note: running icedove-uxp mode sanbox

4
config
View File

@ -307,8 +307,8 @@ set $mode_apps Launch: Shift enable mode private apps [i]ceweasel-uxp ice[d]ove-
mode "$mode_apps" {
bindsym i exec "bash $HOME/.config/bwrap/iceweasel-uxp.bash", mode "default"
bindsym Shift+i exec "bash $HOME/.config/bwrap/iceweasel-uxp-private.bash", mode "default"
bindsym d exec "firejail --seccomp --noroot --disable-mnt icedove-uxp", mode "default"
bindsym Shift+d exec "firejail --seccomp --private icedove-uxp", mode "default"
bindsym d exec "bash $HOME/.config/bwrap/icedove-uxp.bash", mode "default"
bindsym Shift+d exec "bash $HOME/.config/bwrap/icedove-uxp-private.bash", mode "default"
# back to normal: Enter or Escape
bindsym Return mode "default"
bindsym Escape mode "default"