diff options
| -rw-r--r-- | bwrap/icedove-uxp-private.bash | 44 | ||||
| -rw-r--r-- | bwrap/icedove-uxp.bash | 52 | ||||
| -rw-r--r-- | config | 4 |
3 files changed, 98 insertions, 2 deletions
diff --git a/bwrap/icedove-uxp-private.bash b/bwrap/icedove-uxp-private.bash new file mode 100644 index 0000000..6f1af33 --- /dev/null +++ b/bwrap/icedove-uxp-private.bash @@ -0,0 +1,44 @@ +#!/bin/bash + +set -euo pipefail + +(exec bwrap \ + --proc /proc \ + --dev /dev \ + --tmpfs /tmp \ + --dev-bind /dev/dri /dev/dri \ + --ro-bind /etc/fonts /etc/fonts \ + --ro-bind /etc/ssl/certs /etc/ssl/certs \ + --ro-bind /etc/resolv.conf /etc/resolv.conf \ + --ro-bind /lib /lib \ + --ro-bind /lib64 /lib64 \ + --ro-bind /sys/dev/char /sys/dev/char \ + --ro-bind /usr/bin /usr/bin \ + --ro-bind /usr/include/fontconfig /usr/include/fontconfig \ + --ro-bind /usr/lib /usr/lib \ + --ro-bind /usr/lib64 /usr/lib64 \ + --ro-bind /usr/share/applications /usr/share/applications \ + --ro-bind /usr/share/ca-certificates /usr/share/ca-certificates \ + --ro-bind /usr/share/fonts /usr/share/fonts \ + --ro-bind /usr/share/glib-2.0 /usr/share/glib-2.0 \ + --ro-bind /usr/share/icons /usr/share/icons \ + --ro-bind /usr/share/libdrm /usr/share/libdrm \ + --ro-bind /usr/share/mime /usr/share/mime \ + --ro-bind /usr/share/X11/xkb /usr/share/X11/xkb \ + --ro-bind /var/cache/fontconfig /var/cache/fontconfig \ + --ro-bind "${HOME}/.Xauthority" "${HOME}/.Xauthority" \ + --chdir "${HOME}" \ + --unshare-all \ + --share-net \ + --die-with-parent \ + --hostname RESTRICTED \ + --setenv SHELL /bin/false \ + --setenv PATH /usr/bin \ + --file 11 /etc/passwd \ + --file 12 /etc/group \ + --new-session \ + /usr/bin/icedove-uxp) \ + 11< <(getent passwd $UID 65534) \ + 12< <(getent group "$(id -g)" 65534) + +# note: running icedove-uxp on private mode sanbox diff --git a/bwrap/icedove-uxp.bash b/bwrap/icedove-uxp.bash new file mode 100644 index 0000000..72247be --- /dev/null +++ b/bwrap/icedove-uxp.bash @@ -0,0 +1,52 @@ +#!/bin/bash + +set -euo pipefail + +(exec bwrap \ + --proc /proc \ + --dev /dev \ + --tmpfs /tmp \ + --dev-bind /dev/dri /dev/dri \ + --ro-bind /etc/fonts/ /etc/fonts/ \ + --ro-bind /etc/ssl/certs /etc/ssl/certs \ + --ro-bind /etc/resolv.conf /etc/resolv.conf \ + --ro-bind /lib /lib \ + --ro-bind /lib64 /lib64 \ + --ro-bind /sys/dev/char /sys/dev/char \ + --ro-bind /usr/bin /usr/bin \ + --ro-bind /usr/include/fontconfig /usr/include/fontconfig \ + --ro-bind /usr/lib /usr/lib \ + --ro-bind /usr/lib64 /usr/lib64 \ + --ro-bind /usr/share/applications /usr/share/applications \ + --ro-bind /usr/share/ca-certificates /usr/share/ca-certificates \ + --ro-bind /usr/share/fonts /usr/share/fonts \ + --ro-bind /usr/share/glib-2.0 /usr/share/glib-2.0 \ + --ro-bind /usr/share/icons /usr/share/icons \ + --ro-bind /usr/share/libdrm /usr/share/libdrm \ + --ro-bind /usr/share/mime /usr/share/mime \ + --ro-bind /usr/share/X11/xkb /usr/share/X11/xkb \ + --ro-bind /var/cache/fontconfig /var/cache/fontconfig \ + --ro-bind "${HOME}/.Xauthority" "${HOME}/.Xauthority" \ + --bind "${HOME}/.cache/hyperbola" "${HOME}/.cache/hyperbola" \ + --bind "${HOME}/.hyperbola" "${HOME}/.hyperbola" \ + --bind "${HOME}/.config/gtk-2.0" "${HOME}/.config/gtk-2.0" \ + --bind "${HOME}/.gtkrc-2.0" "${HOME}/.gtkrc-2.0" \ + --bind "${HOME}/.icons" "${HOME}/.icons" \ + --bind "${HOME}/.local/share/fonts" "${HOME}/.local/share/fonts" \ + --bind "${HOME}/.themes" "${HOME}/.themes" \ + --bind "${HOME}/Descargas" "${HOME}/Descargas" \ + --chdir "${HOME}" \ + --unshare-all \ + --share-net \ + --die-with-parent \ + --hostname RESTRICTED \ + --setenv SHELL /bin/false \ + --setenv PATH /usr/bin \ + --file 11 /etc/passwd \ + --file 12 /etc/group \ + --new-session \ + /usr/bin/icedove-uxp) \ + 11< <(getent passwd $UID 65534) \ + 12< <(getent group "$(id -g)" 65534) + +# note: running icedove-uxp mode sanbox @@ -307,8 +307,8 @@ set $mode_apps Launch: Shift enable mode private apps [i]ceweasel-uxp ice[d]ove- mode "$mode_apps" { bindsym i exec "bash $HOME/.config/bwrap/iceweasel-uxp.bash", mode "default" bindsym Shift+i exec "bash $HOME/.config/bwrap/iceweasel-uxp-private.bash", mode "default" - bindsym d exec "firejail --seccomp --noroot --disable-mnt icedove-uxp", mode "default" - bindsym Shift+d exec "firejail --seccomp --private icedove-uxp", mode "default" + bindsym d exec "bash $HOME/.config/bwrap/icedove-uxp.bash", mode "default" + bindsym Shift+d exec "bash $HOME/.config/bwrap/icedove-uxp-private.bash", mode "default" # back to normal: Enter or Escape bindsym Return mode "default" bindsym Escape mode "default" |