diff options
| -rw-r--r-- | README.md | 3 | ||||
| -rw-r--r-- | bwrap/iceweasel-uxp-private.bash | 51 | ||||
| -rw-r--r-- | bwrap/iceweasel-uxp.bash | 60 | ||||
| -rw-r--r-- | config | 4 | ||||
| -rw-r--r-- | install.sh | 8 |
5 files changed, 122 insertions, 4 deletions
@@ -23,10 +23,11 @@ This repository saves the custom configuration used by heckyel in i3wm - scrot - sakura - udevil +- bubblewrap ### Optional -- compton +- picom (replace of compton) - lxappearance - ttf-font-awesome - dhcpcd-ui diff --git a/bwrap/iceweasel-uxp-private.bash b/bwrap/iceweasel-uxp-private.bash new file mode 100644 index 0000000..f91c3f4 --- /dev/null +++ b/bwrap/iceweasel-uxp-private.bash @@ -0,0 +1,51 @@ +#!/bin/bash + +set -euo pipefail + +(exec bwrap \ + --proc /proc \ + --dev /dev \ + --tmpfs /tmp \ + --dev-bind /dev/dri /dev/dri \ + --dev-bind /dev/snd /dev/snd \ + --ro-bind /etc/fonts /etc/fonts \ + --ro-bind /etc/ssl/certs /etc/ssl/certs \ + --ro-bind /etc/resolv.conf /etc/resolv.conf \ + --ro-bind /lib /lib \ + --ro-bind /lib64 /lib64 \ + --ro-bind /sys/dev/char /sys/dev/char \ + --ro-bind /sys/devices/pci0000:00 /sys/devices/pci0000:00 \ + --ro-bind /usr/bin /usr/bin \ + --ro-bind /usr/include/fontconfig /usr/include/fontconfig \ + --ro-bind /usr/lib /usr/lib \ + --ro-bind /usr/lib64 /usr/lib64 \ + --ro-bind /usr/share/alsa /usr/share/alsa \ + --ro-bind /usr/share/applications /usr/share/applications \ + --ro-bind /usr/share/ca-certificates /usr/share/ca-certificates \ + --ro-bind /usr/share/fonts /usr/share/fonts \ + --ro-bind /usr/share/glib-2.0 /usr/share/glib-2.0 \ + --ro-bind /usr/share/icons /usr/share/icons \ + --ro-bind /usr/share/libdrm /usr/share/libdrm \ + --ro-bind /usr/share/mime /usr/share/mime \ + --ro-bind /usr/share/X11/xkb /usr/share/X11/xkb \ + --ro-bind /var/cache/fontconfig /var/cache/fontconfig \ + --ro-bind /var/lib/alsa /var/lib/alsa \ + --bind-try /tmp/sndio /tmp/sndio \ + --bind-try /tmp/sndio-1000 /tmp/sndio-1000 \ + --bind-try "${HOME}/.sndio" "${HOME}/.sndio" \ + --bind "${HOME}/Descargas" "${HOME}/Descargas" \ + --chdir "${HOME}" \ + --unshare-all \ + --share-net \ + --die-with-parent \ + --hostname RESTRICTED \ + --setenv SHELL /bin/false \ + --setenv PATH /usr/bin \ + --file 11 /etc/passwd \ + --file 12 /etc/group \ + --new-session \ + /usr/bin/iceweasel-uxp) \ + 11< <(getent passwd $UID 65534) \ + 12< <(getent group "$(id -g)" 65534) + +# note: running iceweasel-uxp on private mode sanbox diff --git a/bwrap/iceweasel-uxp.bash b/bwrap/iceweasel-uxp.bash new file mode 100644 index 0000000..3625468 --- /dev/null +++ b/bwrap/iceweasel-uxp.bash @@ -0,0 +1,60 @@ +#!/bin/bash + +set -euo pipefail + +(exec bwrap \ + --proc /proc \ + --dev /dev \ + --tmpfs /tmp \ + --dev-bind /dev/dri /dev/dri \ + --dev-bind /dev/snd /dev/snd \ + --ro-bind /etc/fonts/ /etc/fonts/ \ + --ro-bind /etc/sndio.conf /etc/sndio.conf \ + --ro-bind /etc/ssl/certs /etc/ssl/certs \ + --ro-bind /etc/resolv.conf /etc/resolv.conf \ + --ro-bind /lib /lib \ + --ro-bind /lib64 /lib64 \ + --ro-bind /sys/dev/char /sys/dev/char \ + --ro-bind /sys/devices/pci0000:00 /sys/devices/pci0000:00 \ + --ro-bind /usr/bin /usr/bin \ + --ro-bind /usr/include/fontconfig /usr/include/fontconfig \ + --ro-bind /usr/lib /usr/lib \ + --ro-bind /usr/lib64 /usr/lib64 \ + --ro-bind /usr/share/alsa /usr/share/alsa \ + --ro-bind /usr/share/applications /usr/share/applications \ + --ro-bind /usr/share/ca-certificates /usr/share/ca-certificates \ + --ro-bind /usr/share/fonts /usr/share/fonts \ + --ro-bind /usr/share/glib-2.0 /usr/share/glib-2.0 \ + --ro-bind /usr/share/icons /usr/share/icons \ + --ro-bind /usr/share/libdrm /usr/share/libdrm \ + --ro-bind /usr/share/mime /usr/share/mime \ + --ro-bind /usr/share/X11/xkb /usr/share/X11/xkb \ + --ro-bind /var/cache/fontconfig /var/cache/fontconfig \ + --ro-bind /var/lib/alsa /var/lib/alsa \ + --bind-try /tmp/sndio /tmp/sndio \ + --bind-try /tmp/sndio-1000 /tmp/sndio-1000 \ + --bind-try "${HOME}/.sndio" "${HOME}/.sndio" \ + --ro-bind "${HOME}/.Xauthority" "${HOME}/.Xauthority" \ + --bind "${HOME}/.cache/hyperbola" "${HOME}/.cache/hyperbola" \ + --bind "${HOME}/.hyperbola" "${HOME}/.hyperbola" \ + --bind "${HOME}/.config/gtk-2.0" "${HOME}/.config/gtk-2.0" \ + --bind "${HOME}/.gtkrc-2.0" "${HOME}/.gtkrc-2.0" \ + --bind "${HOME}/.icons" "${HOME}/.icons" \ + --bind "${HOME}/.local/share/fonts" "${HOME}/.local/share/fonts" \ + --bind "${HOME}/.themes" "${HOME}/.themes" \ + --bind "${HOME}/Descargas" "${HOME}/Descargas" \ + --chdir "${HOME}" \ + --unshare-all \ + --share-net \ + --die-with-parent \ + --hostname RESTRICTED \ + --setenv SHELL /bin/false \ + --setenv PATH /usr/bin \ + --file 11 /etc/passwd \ + --file 12 /etc/group \ + --new-session \ + /usr/bin/iceweasel-uxp) \ + 11< <(getent passwd $UID 65534) \ + 12< <(getent group "$(id -g)" 65534) + +# note: running iceweasel-uxp mode sanbox @@ -305,8 +305,8 @@ bindsym $mod+Shift+p mode "$mode_display_on_off" # Icedove-UXP or return to the default mode, respectively. set $mode_apps Launch: Shift enable mode private apps [i]ceweasel-uxp ice[d]ove-uxp mode "$mode_apps" { - bindsym i exec "firejail --seccomp --noroot --disable-mnt iceweasel-uxp", mode "default" - bindsym Shift+i exec "firejail --seccomp --private iceweasel-uxp", mode "default" + bindsym i exec "bash $HOME/.config/bwrap/iceweasel-uxp.bash", mode "default" + bindsym Shift+i exec "bash $HOME/.config/bwrap/iceweasel-uxp-private.bash", mode "default" bindsym d exec "firejail --seccomp --noroot --disable-mnt icedove-uxp", mode "default" bindsym Shift+d exec "firejail --seccomp --private icedove-uxp", mode "default" # back to normal: Enter or Escape @@ -20,7 +20,7 @@ do $root_key pacman -S --noconfirm i3-wm i3status dmenu sysstat # i3 blocks and dependecies $root_key pacman -S --noconfirm i3blocks i3lock rofi \ - conky acpi scrot sakura feh ranger \ + conky acpi scrot sakura feh ranger bubblewrap \ ttf-hack xenocara-xbacklight elif [[ $(command -v apt-get) ]]; then $root_key apt update -y @@ -55,6 +55,12 @@ do install -d -m755 "$HOME/.config/conky/" install -m644 -v /tmp/i3config/extra/conky.conf "$HOME/.config/conky/" + printf '%b%s%b%s%b\n' '\e[1;32m' '==> ' '\e[0m\033[1m' 'Copying bubblewrap scripts...' '\e[m' + install -d -m755 "$HOME/.config/bwrap/" + for i in /tmp/i3config/bwrap/*.bash; do + install -m644 -v "$i" "$HOME/.config/bwrap/" + done + printf '%b%s%b%s%b\n' '\e[1;32m' '==> ' '\e[0m\033[1m' 'Copying FontAwesome...' '\e[m' install -d -m755 "$HOME/.local/share/fonts/" for i in /tmp/i3config/fonts/*.ttf; do |