heckyel/i3-config
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bwrap: add ungoogled-chromium (GNU Guix) support

Browse Source
This commit is contained in:
Jesús 2021-11-26 22:53:29 -05:00
parent fde85f7bda
commit f8e094a6d4
No known key found for this signature in database
GPG Key ID: F6EE7BC59A315766
2 changed files with 118 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

55
bwrap/ungoogled-chromium-private.bash Normal file
View File

@ -0,0 +1,55 @@
#!/bin/bash
set -euo pipefail
(exec bwrap \
--proc /proc \
--dev /dev \
--tmpfs /tmp \
--dev-bind /dev/dri /dev/dri \
--dev-bind /dev/snd /dev/snd \
--ro-bind /etc/fonts/ /etc/fonts/ \
--ro-bind /etc/sndio.conf /etc/sndio.conf \
--ro-bind /etc/ssl/certs /etc/ssl/certs \
--ro-bind /etc/resolv.conf /etc/resolv.conf \
--ro-bind /lib /lib \
--ro-bind /lib64 /lib64 \
--ro-bind /sys/dev/char /sys/dev/char \
--ro-bind /sys/devices /sys/devices \
--ro-bind /usr/bin /usr/bin \
--ro-bind /usr/include/fontconfig /usr/include/fontconfig \
--ro-bind /usr/lib /usr/lib \
--ro-bind /usr/lib64 /usr/lib64 \
--ro-bind /usr/share/alsa /usr/share/alsa \
--ro-bind /usr/share/applications /usr/share/applications \
--ro-bind /usr/share/ca-certificates /usr/share/ca-certificates \
--ro-bind /usr/share/fonts /usr/share/fonts \
--ro-bind /usr/share/glib-2.0 /usr/share/glib-2.0 \
--ro-bind /usr/share/icons /usr/share/icons \
--ro-bind /usr/share/libdrm /usr/share/libdrm \
--ro-bind /usr/share/mime /usr/share/mime \
--ro-bind /usr/share/X11/xkb /usr/share/X11/xkb \
--ro-bind /var/cache/fontconfig /var/cache/fontconfig \
--ro-bind /var/lib/alsa /var/lib/alsa \
--ro-bind /var/guix /var/guix \
--ro-bind /gnu/store/ gnu/store \
--bind-try /tmp/sndio /tmp/sndio \
--bind-try /tmp/sndio-"$(id -u)" /tmp/sndio-"$(id -u)" \
--bind-try "${HOME}/.sndio" "${HOME}/.sndio" \
--bind "${HOME}/.guix-profile" "${HOME}/.guix-profile" \
--bind "$(xdg-user-dir DOWNLOAD)" "$(xdg-user-dir DOWNLOAD)" \
--chdir "${HOME}" \
--unshare-all \
--share-net \
--die-with-parent \
--hostname RESTRICTED \
--setenv SHELL /bin/false \
--setenv PATH $HOME/.guix-profile/bin:/usr/bin:/bin \
--file 11 /etc/passwd \
--file 12 /etc/group \
--new-session \
$HOME/.guix-profile/bin/chromium) \
11< <(getent passwd $UID 65534 audio) \
12< <(getent group "$(id -g)" 65534 audio)
# note: running ungoogled-chromium (GNU Guix) on private mode sanbox

63
bwrap/ungoogled-chromium.bash Normal file
View File

@ -0,0 +1,63 @@
#!/bin/bash
set -euo pipefail
(exec bwrap \
--proc /proc \
--dev /dev \
--tmpfs /tmp \
--dev-bind /dev/dri /dev/dri \
--dev-bind /dev/snd /dev/snd \
--ro-bind /etc/fonts/ /etc/fonts/ \
--ro-bind /etc/sndio.conf /etc/sndio.conf \
--ro-bind /etc/ssl/certs /etc/ssl/certs \
--ro-bind /etc/resolv.conf /etc/resolv.conf \
--ro-bind /lib /lib \
--ro-bind /lib64 /lib64 \
--ro-bind /sys/dev/char /sys/dev/char \
--ro-bind /sys/devices /sys/devices \
--ro-bind /usr/bin /usr/bin \
--ro-bind /usr/include/fontconfig /usr/include/fontconfig \
--ro-bind /usr/lib /usr/lib \
--ro-bind /usr/lib64 /usr/lib64 \
--ro-bind /usr/share/alsa /usr/share/alsa \
--ro-bind /usr/share/applications /usr/share/applications \
--ro-bind /usr/share/ca-certificates /usr/share/ca-certificates \
--ro-bind /usr/share/fonts /usr/share/fonts \
--ro-bind /usr/share/glib-2.0 /usr/share/glib-2.0 \
--ro-bind /usr/share/icons /usr/share/icons \
--ro-bind /usr/share/libdrm /usr/share/libdrm \
--ro-bind /usr/share/mime /usr/share/mime \
--ro-bind /usr/share/X11/xkb /usr/share/X11/xkb \
--ro-bind /var/cache/fontconfig /var/cache/fontconfig \
--ro-bind /var/lib/alsa /var/lib/alsa \
--ro-bind /var/guix /var/guix \
--ro-bind /gnu/store/ gnu/store \
--bind-try /tmp/sndio /tmp/sndio \
--bind-try /tmp/sndio-"$(id -u)" /tmp/sndio-"$(id -u)" \
--bind-try "${HOME}/.sndio" "${HOME}/.sndio" \
--ro-bind "${HOME}/.Xauthority" "${HOME}/.Xauthority" \
--bind "${HOME}/.cache/chromium" "${HOME}/.cache/chromium" \
--bind "${HOME}/.config/chromium" "${HOME}/.config/chromium" \
--bind "${HOME}/.config/gtk-2.0" "${HOME}/.config/gtk-2.0" \
--bind "${HOME}/.gtkrc-2.0" "${HOME}/.gtkrc-2.0" \
--bind "$HOME/.guix-profile" "$HOME/.guix-profile" \
--bind "${HOME}/.icons" "${HOME}/.icons" \
--bind "${HOME}/.local/share/fonts" "${HOME}/.local/share/fonts" \
--bind "${HOME}/.themes" "${HOME}/.themes" \
--bind "$(xdg-user-dir DOWNLOAD)" "$(xdg-user-dir DOWNLOAD)" \
--chdir "${HOME}" \
--unshare-all \
--share-net \
--die-with-parent \
--hostname RESTRICTED \
--setenv SHELL /bin/false \
--setenv PATH $HOME/.guix-profile/bin:/usr/bin:/bin \
--file 11 /etc/passwd \
--file 12 /etc/group \
--new-session \
$HOME/.guix-profile/bin/chromium) \
11< <(getent passwd $UID 65534 audio) \
12< <(getent group "$(id -g)" 65534 audio)
# note: running ungoogled-chromium (GNU Guix) mode sanbox