Add bubblewrap

README.md

@@ -23,10 +23,11 @@ This repository saves the custom configuration used by heckyel in i3wm
 - scrot
 - sakura
 - udevil
+- bubblewrap
 
 ### Optional
 
-- compton
+- picom (replace of compton)
 - lxappearance
 - ttf-font-awesome
 - dhcpcd-ui

bwrap/iceweasel-uxp-private.bash

@@ -0,0 +1,51 @@
+#!/bin/bash
+
+set -euo pipefail
+
+(exec bwrap \
+      --proc /proc \
+      --dev /dev \
+      --tmpfs /tmp \
+      --dev-bind /dev/dri /dev/dri \
+      --dev-bind /dev/snd /dev/snd \
+      --ro-bind /etc/fonts /etc/fonts \
+      --ro-bind /etc/ssl/certs /etc/ssl/certs \
+      --ro-bind /etc/resolv.conf /etc/resolv.conf \
+      --ro-bind /lib /lib \
+      --ro-bind /lib64 /lib64 \
+      --ro-bind /sys/dev/char /sys/dev/char \
+      --ro-bind /sys/devices/pci0000:00 /sys/devices/pci0000:00 \
+      --ro-bind /usr/bin /usr/bin \
+      --ro-bind /usr/include/fontconfig /usr/include/fontconfig \
+      --ro-bind /usr/lib /usr/lib \
+      --ro-bind /usr/lib64 /usr/lib64 \
+      --ro-bind /usr/share/alsa /usr/share/alsa \
+      --ro-bind /usr/share/applications /usr/share/applications \
+      --ro-bind /usr/share/ca-certificates /usr/share/ca-certificates \
+      --ro-bind /usr/share/fonts /usr/share/fonts \
+      --ro-bind /usr/share/glib-2.0 /usr/share/glib-2.0 \
+      --ro-bind /usr/share/icons /usr/share/icons \
+      --ro-bind /usr/share/libdrm /usr/share/libdrm \
+      --ro-bind /usr/share/mime /usr/share/mime \
+      --ro-bind /usr/share/X11/xkb /usr/share/X11/xkb \
+      --ro-bind /var/cache/fontconfig /var/cache/fontconfig \
+      --ro-bind /var/lib/alsa /var/lib/alsa \
+      --bind-try /tmp/sndio /tmp/sndio \
+      --bind-try /tmp/sndio-1000 /tmp/sndio-1000 \
+      --bind-try "${HOME}/.sndio" "${HOME}/.sndio" \
+      --bind "${HOME}/Descargas" "${HOME}/Descargas" \
+      --chdir "${HOME}" \
+      --unshare-all \
+      --share-net \
+      --die-with-parent \
+      --hostname RESTRICTED \
+      --setenv SHELL /bin/false \
+      --setenv PATH /usr/bin \
+      --file 11 /etc/passwd \
+      --file 12 /etc/group \
+      --new-session \
+      /usr/bin/iceweasel-uxp) \
+    11< <(getent passwd $UID 65534) \
+    12< <(getent group "$(id -g)" 65534)
+
+# note: running iceweasel-uxp on private mode sanbox

bwrap/iceweasel-uxp.bash

@@ -0,0 +1,60 @@
+#!/bin/bash
+
+set -euo pipefail
+
+(exec bwrap \
+      --proc /proc \
+      --dev /dev \
+      --tmpfs /tmp \
+      --dev-bind /dev/dri /dev/dri \
+      --dev-bind /dev/snd /dev/snd \
+      --ro-bind /etc/fonts/ /etc/fonts/ \
+      --ro-bind /etc/sndio.conf /etc/sndio.conf \
+      --ro-bind /etc/ssl/certs /etc/ssl/certs \
+      --ro-bind /etc/resolv.conf /etc/resolv.conf \
+      --ro-bind /lib /lib \
+      --ro-bind /lib64 /lib64 \
+      --ro-bind /sys/dev/char /sys/dev/char \
+      --ro-bind /sys/devices/pci0000:00 /sys/devices/pci0000:00 \
+      --ro-bind /usr/bin /usr/bin \
+      --ro-bind /usr/include/fontconfig /usr/include/fontconfig \
+      --ro-bind /usr/lib /usr/lib \
+      --ro-bind /usr/lib64 /usr/lib64 \
+      --ro-bind /usr/share/alsa /usr/share/alsa \
+      --ro-bind /usr/share/applications /usr/share/applications \
+      --ro-bind /usr/share/ca-certificates /usr/share/ca-certificates \
+      --ro-bind /usr/share/fonts /usr/share/fonts \
+      --ro-bind /usr/share/glib-2.0 /usr/share/glib-2.0 \
+      --ro-bind /usr/share/icons /usr/share/icons \
+      --ro-bind /usr/share/libdrm /usr/share/libdrm \
+      --ro-bind /usr/share/mime /usr/share/mime \
+      --ro-bind /usr/share/X11/xkb /usr/share/X11/xkb \
+      --ro-bind /var/cache/fontconfig /var/cache/fontconfig \
+      --ro-bind /var/lib/alsa /var/lib/alsa \
+      --bind-try /tmp/sndio /tmp/sndio \
+      --bind-try /tmp/sndio-1000 /tmp/sndio-1000 \
+      --bind-try "${HOME}/.sndio" "${HOME}/.sndio" \
+      --ro-bind "${HOME}/.Xauthority" "${HOME}/.Xauthority" \
+      --bind "${HOME}/.cache/hyperbola" "${HOME}/.cache/hyperbola" \
+      --bind "${HOME}/.hyperbola" "${HOME}/.hyperbola" \
+      --bind "${HOME}/.config/gtk-2.0" "${HOME}/.config/gtk-2.0" \
+      --bind "${HOME}/.gtkrc-2.0" "${HOME}/.gtkrc-2.0" \
+      --bind "${HOME}/.icons" "${HOME}/.icons" \
+      --bind "${HOME}/.local/share/fonts" "${HOME}/.local/share/fonts" \
+      --bind "${HOME}/.themes" "${HOME}/.themes" \
+      --bind "${HOME}/Descargas" "${HOME}/Descargas" \
+      --chdir "${HOME}" \
+      --unshare-all \
+      --share-net \
+      --die-with-parent \
+      --hostname RESTRICTED \
+      --setenv SHELL /bin/false \
+      --setenv PATH /usr/bin \
+      --file 11 /etc/passwd \
+      --file 12 /etc/group \
+      --new-session \
+      /usr/bin/iceweasel-uxp) \
+    11< <(getent passwd $UID 65534) \
+    12< <(getent group "$(id -g)" 65534)
+
+# note: running iceweasel-uxp mode sanbox

config

@@ -305,8 +305,8 @@ bindsym $mod+Shift+p mode "$mode_display_on_off"
 # Icedove-UXP or return to the default mode, respectively.
 set $mode_apps Launch: Shift enable mode private apps [i]ceweasel-uxp ice[d]ove-uxp
 mode "$mode_apps" {
-    bindsym i exec "firejail --seccomp --noroot --disable-mnt iceweasel-uxp", mode "default"
+    bindsym i exec "bash $HOME/.config/bwrap/iceweasel-uxp.bash", mode "default"
-    bindsym Shift+i exec "firejail --seccomp --private iceweasel-uxp", mode "default"
+    bindsym Shift+i exec "bash $HOME/.config/bwrap/iceweasel-uxp-private.bash", mode "default"
     bindsym d exec "firejail --seccomp --noroot --disable-mnt icedove-uxp", mode "default"
     bindsym Shift+d exec "firejail --seccomp --private icedove-uxp", mode "default"
     # back to normal: Enter or Escape

install.sh

@@ -20,7 +20,7 @@ do
             $root_key pacman -S --noconfirm i3-wm i3status dmenu sysstat
             # i3 blocks and dependecies
             $root_key pacman -S --noconfirm i3blocks i3lock rofi \
-                      conky acpi scrot sakura feh ranger \
+                      conky acpi scrot sakura feh ranger bubblewrap \
                       ttf-hack xenocara-xbacklight
         elif [[ $(command -v apt-get) ]]; then
             $root_key apt update -y
@@ -55,6 +55,12 @@ do
         install -d -m755 "$HOME/.config/conky/"
         install -m644 -v /tmp/i3config/extra/conky.conf "$HOME/.config/conky/"
 
+        printf '%b%s%b%s%b\n' '\e[1;32m' '==> ' '\e[0m\033[1m' 'Copying bubblewrap scripts...' '\e[m'
+        install -d -m755 "$HOME/.config/bwrap/"
+        for i in /tmp/i3config/bwrap/*.bash; do
+            install -m644 -v "$i" "$HOME/.config/bwrap/"
+        done
+
         printf '%b%s%b%s%b\n' '\e[1;32m' '==> ' '\e[0m\033[1m' 'Copying FontAwesome...' '\e[m'
         install -d -m755 "$HOME/.local/share/fonts/"
         for i in /tmp/i3config/fonts/*.ttf; do