1 files changed, 51 insertions, 0 deletions
diff --git a/bwrap/iceweasel-uxp-private.bash b/bwrap/iceweasel-uxp-private.bash
new file mode 100644
index 0000000..f91c3f4
--- /dev/null
+++ b/bwrap/iceweasel-uxp-private.bash
@@ -0,0 +1,51 @@
+#!/bin/bash
+
+set -euo pipefail
+
+(exec bwrap \
+      --proc /proc \
+      --dev /dev \
+      --tmpfs /tmp \
+      --dev-bind /dev/dri /dev/dri \
+      --dev-bind /dev/snd /dev/snd \
+      --ro-bind /etc/fonts /etc/fonts \
+      --ro-bind /etc/ssl/certs /etc/ssl/certs \
+      --ro-bind /etc/resolv.conf /etc/resolv.conf \
+      --ro-bind /lib /lib \
+      --ro-bind /lib64 /lib64 \
+      --ro-bind /sys/dev/char /sys/dev/char \
+      --ro-bind /sys/devices/pci0000:00 /sys/devices/pci0000:00 \
+      --ro-bind /usr/bin /usr/bin \
+      --ro-bind /usr/include/fontconfig /usr/include/fontconfig \
+      --ro-bind /usr/lib /usr/lib \
+      --ro-bind /usr/lib64 /usr/lib64 \
+      --ro-bind /usr/share/alsa /usr/share/alsa \
+      --ro-bind /usr/share/applications /usr/share/applications \
+      --ro-bind /usr/share/ca-certificates /usr/share/ca-certificates \
+      --ro-bind /usr/share/fonts /usr/share/fonts \
+      --ro-bind /usr/share/glib-2.0 /usr/share/glib-2.0 \
+      --ro-bind /usr/share/icons /usr/share/icons \
+      --ro-bind /usr/share/libdrm /usr/share/libdrm \
+      --ro-bind /usr/share/mime /usr/share/mime \
+      --ro-bind /usr/share/X11/xkb /usr/share/X11/xkb \
+      --ro-bind /var/cache/fontconfig /var/cache/fontconfig \
+      --ro-bind /var/lib/alsa /var/lib/alsa \
+      --bind-try /tmp/sndio /tmp/sndio \
+      --bind-try /tmp/sndio-1000 /tmp/sndio-1000 \
+      --bind-try "${HOME}/.sndio" "${HOME}/.sndio" \
+      --bind "${HOME}/Descargas" "${HOME}/Descargas" \
+      --chdir "${HOME}" \
+      --unshare-all \
+      --share-net \
+      --die-with-parent \
+      --hostname RESTRICTED \
+      --setenv SHELL /bin/false \
+      --setenv PATH /usr/bin \
+      --file 11 /etc/passwd \
+      --file 12 /etc/group \
+      --new-session \
+      /usr/bin/iceweasel-uxp) \
+    11< <(getent passwd $UID 65534) \
+    12< <(getent group "$(id -g)" 65534)
+
+# note: running iceweasel-uxp on private mode sanbox