45 lines
1.5 KiB
Bash
45 lines
1.5 KiB
Bash
#!/bin/bash
|
|
|
|
set -euo pipefail
|
|
|
|
(exec bwrap \
|
|
--proc /proc \
|
|
--dev /dev \
|
|
--tmpfs /tmp \
|
|
--dev-bind /dev/dri /dev/dri \
|
|
--ro-bind /etc/fonts /etc/fonts \
|
|
--ro-bind /etc/ssl/certs /etc/ssl/certs \
|
|
--ro-bind /etc/resolv.conf /etc/resolv.conf \
|
|
--ro-bind /lib /lib \
|
|
--ro-bind /lib64 /lib64 \
|
|
--ro-bind /sys/dev/char /sys/dev/char \
|
|
--ro-bind /usr/bin /usr/bin \
|
|
--ro-bind /usr/include/fontconfig /usr/include/fontconfig \
|
|
--ro-bind /usr/lib /usr/lib \
|
|
--ro-bind /usr/lib64 /usr/lib64 \
|
|
--ro-bind /usr/share/applications /usr/share/applications \
|
|
--ro-bind /usr/share/ca-certificates /usr/share/ca-certificates \
|
|
--ro-bind /usr/share/fonts /usr/share/fonts \
|
|
--ro-bind /usr/share/glib-2.0 /usr/share/glib-2.0 \
|
|
--ro-bind /usr/share/icons /usr/share/icons \
|
|
--ro-bind /usr/share/libdrm /usr/share/libdrm \
|
|
--ro-bind /usr/share/mime /usr/share/mime \
|
|
--ro-bind /usr/share/X11/xkb /usr/share/X11/xkb \
|
|
--ro-bind /var/cache/fontconfig /var/cache/fontconfig \
|
|
--ro-bind "${HOME}/.Xauthority" "${HOME}/.Xauthority" \
|
|
--chdir "${HOME}" \
|
|
--unshare-all \
|
|
--share-net \
|
|
--die-with-parent \
|
|
--hostname RESTRICTED \
|
|
--setenv SHELL /bin/false \
|
|
--setenv PATH /usr/bin \
|
|
--file 11 /etc/passwd \
|
|
--file 12 /etc/group \
|
|
--new-session \
|
|
/usr/bin/icedove-uxp) \
|
|
11< <(getent passwd $UID 65534) \
|
|
12< <(getent group "$(id -g)" 65534)
|
|
|
|
# note: running icedove-uxp on private mode sanbox
|