Bubblewrap - Revision history

Prabuanand: reworded sentence and added note on bubblejail

2025-05-11T04:58:08Z

reworded sentence and added note on bubblejail

← Older revision		Revision as of 04:58, 11 May 2025
Line 2:		Line 2:
	{{TOC right}}		{{TOC right}}

	[https://github.com/containers/bubblewrap Bubblewrap] is an		[https://github.com/containers/bubblewrap Bubblewrap] is an unprivileged sandboxing tool. It uses Kernel features like
	unprivileged sandboxing tool. Kernel features ~~it also has:~~		User/IPC/PID/Network/UTS/cgroup, [https://en.wikipedia.org/wiki/Linux_namespaces namespaces] and [https://en.wikipedia.org/wiki/Seccomp Seccomp] filters.
	User/IPC/PID/Network/UTS/cgroup
	[https://en.wikipedia.org/wiki/Linux_namespaces namespaces] and
	[https://en.wikipedia.org/wiki/Seccomp Seccomp] filters.

	~~How bubblewrap works, as stated in the~~		[https://github.com/containers/bubblewrap/blob/main/README.md#usage Bubblewrap] works by creating a new, completely empty, mount namespace where the root is on a tmpfs that is invisible from the host, and will be automatically cleaned up when the last process exits. You can then use commandline options to construct the root filesystem and process environment and command to run in the namespace.
	[https://github.com/containers/bubblewrap/blob/main/README.md#usage ~~README.md~~]:
	~~:bubblewrap~~ works by creating a new, completely empty, mount namespace where the root is on a tmpfs that is invisible from the host, and will be automatically cleaned up when the last process exits. You can then use commandline options to construct the root filesystem and process environment and command to run in the namespace.		Bubblewrap has a simpler GUI frontend called [https://github.com/igo95862/bubblejail Bubblejail]. When installing {{pkg\|Bubblejail}} package, first install the dependencies listed [https://github.com/igo95862/bubblejail/blob/master/docs/distro_notes/alpine.md here].

	== Installation ==		== Installation ==

	Install {{Pkg\|bubblewrap\|arch=}}:		Install {{Pkg\|bubblewrap\|arch=}} package as follows: {{Cmd\|# apk add bubblewrap}}

	{{Cmd\|# apk add bubblewrap}}

	~~{{Note\|The package is {{pkg\|bubblewrap\|arch=}} but the command to~~
	~~manage it is {{Ic\|bwrap}}.~~}}

	== How to workout what a program needs ==		== How to workout what a program needs ==

	{{Tip\|~~Look at~~ [[Bubblewrap/Examples]] ~~to see~~ various ways {{Ic\|bwrap}} can be used.}}		{{Tip\|{{Ic\|bwrap}} is the the command to manage bubblewrap. [[Bubblewrap/Examples]] page lists various ways {{Ic\|bwrap}} can be used.}}

	=== Prerequisites ===		=== Prerequisites ===
Line 502:		Line 494:
	* [https://wiki.archlinux.org/title/Desktop_entries ArchWiki: Desktop entries (*.desktop files)]		* [https://wiki.archlinux.org/title/Desktop_entries ArchWiki: Desktop entries (*.desktop files)]

	~~[[Category:Desktop]]~~
	[[Category:Security]]		[[Category:Security]]

Encode: Use default values, instead of assign default values. Doesn't matter in this situation, but will lead to surprising results in most situations.

2024-06-05T02:45:01Z

Use default values, instead of assign default values. Doesn't matter in this situation, but will lead to surprising results in most situations.

← Older revision		Revision as of 02:45, 5 June 2024
Line 156:		Line 156:
	[https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html XDG Base Directory]		[https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html XDG Base Directory]
	default:		default:
	XDG_CONFIG_HOME="${XDG_CONFIG_HOME:=$HOME/.config}"		XDG_CONFIG_HOME="${XDG_CONFIG_HOME:-$HOME/.config}"
	this will use {{Path\|"$XDG_CONFIG_HOME"}} if it's set, otherwise		this will use {{Path\|"$XDG_CONFIG_HOME"}} if it's set, otherwise
	fallback to the default of {{Path\|"$HOME/.config"}}.		fallback to the default of {{Path\|"$HOME/.config"}}.
Line 174:		Line 174:
	set -u		set -u

	XDG_CONFIG_HOME{{=}}"${XDG_CONFIG_HOME:~~{{=}}~~$HOME/.config}"		XDG_CONFIG_HOME{{=}}"${XDG_CONFIG_HOME:-$HOME/.config}"

	/usr/bin/bwrap \		/usr/bin/bwrap \
Line 195:		Line 195:
	/usr/libexec/imv-wayland "${1:-./}"}}		/usr/libexec/imv-wayland "${1:-./}"}}

	Now lets run {{Ic\|bwrap-imv}}; go into a directory with an image:		Now lets run {{Ic\|bwrap-imv}}, go into a directory with an image:

	{{Cmd\|$ bwrap-imv IMAGE		{{Cmd\|$ bwrap-imv IMAGE
Line 248:		Line 248:
	set -u		set -u

	XDG_CONFIG_HOME{{=}}"${XDG_CONFIG_HOME:~~{{=}}~~$HOME/.config}"		XDG_CONFIG_HOME{{=}}"${XDG_CONFIG_HOME:-$HOME/.config}"

	/usr/bin/bwrap \		/usr/bin/bwrap \
Line 304:		Line 304:
	[https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html XDG Base Directory]		[https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html XDG Base Directory]
	default:		default:
	XDG_DATA_HOME="${XDG_DATA_HOME:=$HOME/.local/share}"		XDG_DATA_HOME="${XDG_DATA_HOME:-$HOME/.local/share}"
	use {{Path\|"$XDG_DATA_HOME"}} if set, else use {{Path\|"$HOME/.local/share"}}.		use {{Path\|"$XDG_DATA_HOME"}} if set, else use {{Path\|"$HOME/.local/share"}}.

Line 313:		Line 313:
	Pass {{Path\|"$XDG_CACHE_HOME"}} to sandbox:		Pass {{Path\|"$XDG_CACHE_HOME"}} to sandbox:
	--setenv XDG_CACHE_HOME "$XDG_CACHE_HOME" \		--setenv XDG_CACHE_HOME "$XDG_CACHE_HOME" \
	just like for {{Path\|"$XDG_CONFIG_HOME"}}, this isn't always defined; so		just like for {{Path\|"$XDG_CONFIG_HOME"}}, this isn't always defined, so
	fallback to		fallback to
	[https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html XDG Base Directory]		[https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html XDG Base Directory]
	default:		default:
	XDG_CACHE_HOME="${XDG_CACHE_HOME:=$HOME/.cache}"		XDG_CACHE_HOME="${XDG_CACHE_HOME:-$HOME/.cache}"
	use {{Path\|"$XDG_CACHE_HOME"}} if set, else use {{Path\|"$HOME/.cache"}}.		use {{Path\|"$XDG_CACHE_HOME"}} if set, else use {{Path\|"$HOME/.cache"}}.

Line 334:		Line 334:
	set -u		set -u

	XDG_CACHE_HOME{{=}}"${XDG_CACHE_HOME:~~{{=}}~~$HOME/.cache}"		XDG_CACHE_HOME{{=}}"${XDG_CACHE_HOME:-$HOME/.cache}"
	XDG_CONFIG_HOME{{=}}"${XDG_CONFIG_HOME:~~{{=}}~~$HOME/.config}"		XDG_CONFIG_HOME{{=}}"${XDG_CONFIG_HOME:-$HOME/.config}"
	XDG_DATA_HOME{{=}}"${XDG_DATA_HOME:~~{{=}}~~$HOME/.local/share}"		XDG_DATA_HOME{{=}}"${XDG_DATA_HOME:-$HOME/.local/share}"

	/usr/bin/bwrap \		/usr/bin/bwrap \

Encode: Pkg: Search every arch

2024-05-24T07:28:32Z

Pkg: Search every arch

← Older revision		Revision as of 07:28, 24 May 2024
Line 14:		Line 14:
	== Installation ==		== Installation ==

	Install {{Pkg\|bubblewrap}}:		Install {{Pkg\|bubblewrap\|arch=}}:

	{{Cmd\|# apk add bubblewrap}}		{{Cmd\|# apk add bubblewrap}}

	{{Note\|The package is {{pkg\|bubblewrap}} but the command to		{{Note\|The package is {{pkg\|bubblewrap\|arch=}} but the command to
	manage it is {{Ic\|bwrap}}.}}		manage it is {{Ic\|bwrap}}.}}

Line 46:		Line 46:
	{{Note\|With how we will be sandboxing everything that doesn't match our owner/group will show as {{Ic\|nobody}}.}}		{{Note\|With how we will be sandboxing everything that doesn't match our owner/group will show as {{Ic\|nobody}}.}}

	Lets assume you want to sandbox {{Pkg\|imv}} and are using [[Wayland]]		Lets assume you want to sandbox {{Pkg\|imv\|arch=}} and are using [[Wayland]]
	only. Here is how you might go about that.		only. Here is how you might go about that.

Line 116:		Line 116:
	{{Note\|It is not worth the time to limit {{Path\|/usr/lib/*}}, the churn is too great.}}		{{Note\|It is not worth the time to limit {{Path\|/usr/lib/*}}, the churn is too great.}}

	{{Warning\|The {{Ic\|ldd}} manpage talks about some security implications. It may not apply since they seem to be talking about glibc and {{Pkg\|musl-utils}} makes {{Path\|/lib/ld-musl-x86_64.so.1}} ldd [https://git.alpinelinux.org/aports/tree/main/musl/APKBUILD#n105]. Is this something to worry about?}}		{{Warning\|The {{Ic\|ldd}} manpage talks about some security implications. It may not apply since they seem to be talking about glibc and {{Pkg\|musl-utils\|arch=}} makes {{Path\|/lib/ld-musl-x86_64.so.1}} ldd [https://git.alpinelinux.org/aports/tree/main/musl/APKBUILD#n105]. Is this something to worry about?}}

	Since this is a shell script, lets use a helpful command:		Since this is a shell script, lets use a helpful command:
Line 284:		Line 284:

	Look at the {{Ic\|fonts-conf}} manpage (which is from		Look at the {{Ic\|fonts-conf}} manpage (which is from
	{{Pkg\|fontconfig-doc}}) we see that {{Path\|/etc/fonts/}} is the system		{{Pkg\|fontconfig-doc\|arch=}}) we see that {{Path\|/etc/fonts/}} is the system
	font configuration directory and		font configuration directory and
	{{Path\|"${XDG_CONFIG_HOME}/fontconfig/"}} is the per-user configuration		{{Path\|"${XDG_CONFIG_HOME}/fontconfig/"}} is the per-user configuration
Line 422:		Line 422:
	{{Obsolete\|This should probably be documented in [[Default_applications]] and linked here. Nothing is unique in using with {{Ic\|bwrap}}.}}		{{Obsolete\|This should probably be documented in [[Default_applications]] and linked here. Nothing is unique in using with {{Ic\|bwrap}}.}}

	{{Note\|This section is also using {{Pkg\|imv}} as the example.}}		{{Note\|This section is also using {{Pkg\|imv\|arch=}} as the example.}}

	[https://specifications.freedesktop.org/desktop-entry-spec/desktop-entry-spec-latest.html XDG Desktop Entry Specification]		[https://specifications.freedesktop.org/desktop-entry-spec/desktop-entry-spec-latest.html XDG Desktop Entry Specification]
Line 442:		Line 442:
	</nowiki>...}}		</nowiki>...}}

	The program {{Ic\|xdg-open}} (from the {{Pkg\|xdg-utils}} package) can be		The program {{Ic\|xdg-open}} (from the {{Pkg\|xdg-utils\|arch=}} package) can be
	used to open files based on the [https://en.wikipedia.org/wiki/MIME MIME]		used to open files based on the [https://en.wikipedia.org/wiki/MIME MIME]
	type + corresponding entry in		type + corresponding entry in
Line 448:		Line 448:
	{{Path\|"${XDG_DATA_HOME}/applications/mimeinfo.cache"}}.		{{Path\|"${XDG_DATA_HOME}/applications/mimeinfo.cache"}}.

	Install {{Pkg\|desktop-file-utils}} if it is not installed already, it		Install {{Pkg\|desktop-file-utils\|arch=}} if it is not installed already, it
	comes with two commands that are needed {{Ic\|desktop-file-validate}} and		comes with two commands that are needed {{Ic\|desktop-file-validate}} and
	{{Ic\|update-desktop-database}}:		{{Ic\|update-desktop-database}}:

Encode: env isn't necessary

2024-05-20T19:40:14Z

env isn't necessary

← Older revision		Revision as of 19:40, 20 May 2024
Line 168:		Line 168:
	{{Path\|~/.local/bin/bwrap-imv}} now looks like:		{{Path\|~/.local/bin/bwrap-imv}} now looks like:

	{{Cat\|~/.local/bin/bwrap-imv\|#!~~/usr~~/bin/~~env~~ sh		{{Cat\|~/.local/bin/bwrap-imv\|#!/bin/sh

	# imv wrapped in bwrap.		# imv wrapped in bwrap.
Line 242:		Line 242:
	{{Path\|~/.local/bin/bwrap-imv}} should look like:		{{Path\|~/.local/bin/bwrap-imv}} should look like:

	{{Cat\|~/.local/bin/bwrap-imv\|#!~~/usr~~/bin/~~env~~ sh		{{Cat\|~/.local/bin/bwrap-imv\|#!/bin/sh

	# imv wrapped in bwrap.		# imv wrapped in bwrap.
Line 328:		Line 328:
	The updated {{Path\|~/.local/bin/bwrap-imv}} should look like this:		The updated {{Path\|~/.local/bin/bwrap-imv}} should look like this:

	{{Cat\|~/.local/bin/bwrap-imv\|#!~~/usr~~/bin/~~env~~ sh		{{Cat\|~/.local/bin/bwrap-imv\|#!/bin/sh

	# imv wrapped in bwrap.		# imv wrapped in bwrap.

Sertonix: fix template ic -> pkg

2023-11-17T11:00:36Z

fix template ic -> pkg

← Older revision		Revision as of 11:00, 17 November 2023
Line 18:		Line 18:
	{{Cmd\|# apk add bubblewrap}}		{{Cmd\|# apk add bubblewrap}}

	{{Note\|The package is {{Ic\|bubblewrap}} but the command to		{{Note\|The package is {{pkg\|bubblewrap}} but the command to
	manage it is {{Ic\|bwrap}}.}}		manage it is {{Ic\|bwrap}}.}}

Encode: Finish fleshing out the explanation of the process.

2023-11-14T07:50:50Z

Finish fleshing out the explanation of the process.

Show changes

Encode: Limit /lib/*

2023-09-07T04:50:11Z

Limit /lib/*

← Older revision		Revision as of 04:50, 7 September 2023
Line 85:		Line 85:
	{{Ic\|"${@:-./}"}}, this will generate a separate word for each		{{Ic\|"${@:-./}"}}, this will generate a separate word for each
	positional parameter and if you didn't have any parameters it will		positional parameter and if you didn't have any parameters it will
	default to current directory.		default to the current directory:
			/usr/libexec/imv-wayland "${@:-./}"

	~~Running {{Ic\|ldd}} to find all~~ necessary ~~libs~~, except ones loaded at		Find necessary shared libraries, except ones loaded at runtime:
	~~runtime, on~~ {{~~Path~~\|/usr/libexec/imv-wayland}}, outputs a lot of things but
	~~for the moment all~~ we ~~care about are~~ the directory ~~paths. Specifically~~		{{Cmd\|$ ldd /usr/libexec/imv-wayland}}
	the ~~starting directories, which are~~ {{Ic\|/lib/}} and {{Ic\|/usr/lib/}}.
			It outputs a lot of things but we only need a few; the directory path of
			the majority {{Path\|/usr/lib/*}} and the 4 paths that start with
			{{Path\|/lib/*}}. Filter the output to see it clearer:

			{{Cmd\|$ ldd /usr/libexec/imv-wayland {{!}} grep ' /lib/'}}

			In total:
			--ro-bind /lib/ld-musl-x86_64.so.1 /lib/ld-musl-x86_64.so.1 \
			--ro-bind /lib/libblkid.so.1 /lib/libblkid.so.1 \
			--ro-bind /lib/libmount.so.1 /lib/libmount.so.1 \
			--ro-bind /lib/libz.so.1 /lib/libz.so.1 \
			--ro-bind /usr/lib/ /usr/lib/ \

	{{Warning\|The {{Ic\|ldd}} manpage talks about some security implications. It may not apply since they seem to be talking about glibc and {{Pkg\|musl-utils}} makes {{Path\|/lib/ld-musl-x86_64.so.1}} ldd [https://git.alpinelinux.org/aports/tree/main/musl/APKBUILD#n105]. Is this something to worry about?}}		{{Warning\|The {{Ic\|ldd}} manpage talks about some security implications. It may not apply since they seem to be talking about glibc and {{Pkg\|musl-utils}} makes {{Path\|/lib/ld-musl-x86_64.so.1}} ldd [https://git.alpinelinux.org/aports/tree/main/musl/APKBUILD#n105]. Is this something to worry about?}}
Line 169:		Line 182:
	--dev-bind /dev/null /dev/null \		--dev-bind /dev/null /dev/null \
	--ro-bind-try "${XDG_CONFIG_HOME}/imv/config" "${XDG_CONFIG_HOME}/imv/config" \		--ro-bind-try "${XDG_CONFIG_HOME}/imv/config" "${XDG_CONFIG_HOME}/imv/config" \
	--ro-bind /lib/ /lib/ \		--ro-bind /lib/ld-musl-x86_64.so.1 /lib/ld-musl-x86_64.so.1 \
			--ro-bind /lib/libblkid.so.1 /lib/libblkid.so.1 \
			--ro-bind /lib/libmount.so.1 /lib/libmount.so.1 \
			--ro-bind /lib/libz.so.1 /lib/libz.so.1 \
	--ro-bind "${XDG_RUNTIME_DIR}/${WAYLAND_DISPLAY}" "${XDG_RUNTIME_DIR}/${WAYLAND_DISPLAY}" \		--ro-bind "${XDG_RUNTIME_DIR}/${WAYLAND_DISPLAY}" "${XDG_RUNTIME_DIR}/${WAYLAND_DISPLAY}" \
	--ro-bind /usr/lib/ /usr/lib/ \		--ro-bind /usr/lib/ /usr/lib/ \
Line 235:		Line 251:
	--dev-bind /dev/null /dev/null \		--dev-bind /dev/null /dev/null \
	--ro-bind-try "${XDG_CONFIG_HOME}/imv/config" "${XDG_CONFIG_HOME}/imv/config" \		--ro-bind-try "${XDG_CONFIG_HOME}/imv/config" "${XDG_CONFIG_HOME}/imv/config" \
	--ro-bind /lib/ /lib/ \		--ro-bind /lib/ld-musl-x86_64.so.1 /lib/ld-musl-x86_64.so.1 \
			--ro-bind /lib/libblkid.so.1 /lib/libblkid.so.1 \
			--ro-bind /lib/libmount.so.1 /lib/libmount.so.1 \
			--ro-bind /lib/libz.so.1 /lib/libz.so.1 \
	--ro-bind /sys/dev/char/ /sys/dev/char/ \		--ro-bind /sys/dev/char/ /sys/dev/char/ \
	--ro-bind /sys/devices/pci0000:00/ /sys/devices/pci0000:00/ \		--ro-bind /sys/devices/pci0000:00/ /sys/devices/pci0000:00/ \
Line 323:		Line 342:
	--dev-bind /dev/dri/renderD128 /dev/dri/renderD128 \		--dev-bind /dev/dri/renderD128 /dev/dri/renderD128 \
	--dev-bind /dev/null /dev/null \		--dev-bind /dev/null /dev/null \
			--ro-bind /etc/fonts/ /etc/fonts/ \
	--bind-try "${XDG_CACHE_HOME}/fontconfig/" "${XDG_CACHE_HOME}/fontconfig/" \		--bind-try "${XDG_CACHE_HOME}/fontconfig/" "${XDG_CACHE_HOME}/fontconfig/" \
	--ro-bind-try "${XDG_CONFIG_HOME}/fontconfig/" "${XDG_CONFIG_HOME}/fontconfig/" \		--ro-bind-try "${XDG_CONFIG_HOME}/fontconfig/" "${XDG_CONFIG_HOME}/fontconfig/" \
	--ro-bind-try "${XDG_CONFIG_HOME}/imv/config" "${XDG_CONFIG_HOME}/imv/config" \		--ro-bind-try "${XDG_CONFIG_HOME}/imv/config" "${XDG_CONFIG_HOME}/imv/config" \
	--ro-bind-try "${XDG_DATA_HOME}/fonts/" "${XDG_DATA_HOME}/fonts/" \		--ro-bind-try "${XDG_DATA_HOME}/fonts/" "${XDG_DATA_HOME}/fonts/" \
	--ro-bind /~~etc~~/~~fonts~~/ /~~etc~~/~~fonts~~/ \		--ro-bind /lib/ld-musl-x86_64.so.1 /lib/ld-musl-x86_64.so.1 \
	--ro-bind /lib/ /lib/ \		--ro-bind /lib/libblkid.so.1 /lib/libblkid.so.1 \
			--ro-bind /lib/libmount.so.1 /lib/libmount.so.1 \
			--ro-bind /lib/libz.so.1 /lib/libz.so.1 \
	--ro-bind /sys/dev/char/ /sys/dev/char/ \		--ro-bind /sys/dev/char/ /sys/dev/char/ \
	--ro-bind /sys/devices/pci0000:00/ /sys/devices/pci0000:00/ \		--ro-bind /sys/devices/pci0000:00/ /sys/devices/pci0000:00/ \

Encode: Tip the first note about Bubblewrap/Examples; make exploring the sandbox its own heading.

2023-09-06T05:45:30Z

Tip the first note about Bubblewrap/Examples; make exploring the sandbox its own heading.

← Older revision		Revision as of 05:45, 6 September 2023
Line 23:		Line 23:
	== How to workout what a program needs ==		== How to workout what a program needs ==

	Look at [[Bubblewrap/Examples]] to see various ways ~~bubblewrap~~ can be used.		{{Tip\|Look at [[Bubblewrap/Examples]] to see various ways {{Ic\|bwrap}} can be used.}}

	=== Prerequisites ===		=== Prerequisites ===
Line 339:		Line 339:
	--ro-bind "${@:-./}" "$(realpath "${@:-./}")" \		--ro-bind "${@:-./}" "$(realpath "${@:-./}")" \
	/usr/libexec/imv-wayland "${@:-./}"}}		/usr/libexec/imv-wayland "${@:-./}"}}

			==== See what exists in the sandbox ====

	Finally test what all is allowed by replacing		Finally test what all is allowed by replacing
	{{Ic\|/usr/libexec/imv-wayland "${@:-./}")}} with {{Ic\|/bin/sh}} and		{{Ic\|/usr/libexec/imv-wayland "${@:-./}"}} with {{Ic\|/bin/sh}} and
	adding {{Ic\|--ro-bind /bin/ /bin/ \}}. Check around and see what the		adding {{Ic\|--ro-bind /bin/ /bin/ \}}. Check around and see what the
	filesystem is like:		filesystem is like:
Line 348:		Line 350:
	--ro-bind "${@:-./}" "$(realpath "${@:-./}")" \		--ro-bind "${@:-./}" "$(realpath "${@:-./}")" \
	--ro-bind /bin/ /bin/ \		--ro-bind /bin/ /bin/ \
	/bin/sh)}}		/bin/sh}}

	Invoke {{Ic\|bwrap-imv}}:		Invoke {{Ic\|bwrap-imv}}:

	{{Cmd\|$ bwrap-imv}}		{{Cmd\|$ bwrap-imv IMAGE}}

	Show what environment variables are active:		Show what environment variables are active:
Line 378:		Line 380:
	{{Cat\|~/.local/bin/bwrap-imv\| ...		{{Cat\|~/.local/bin/bwrap-imv\| ...
	--ro-bind "${@:-./}" "$(realpath "${@:-./}")" \		--ro-bind "${@:-./}" "$(realpath "${@:-./}")" \
	/usr/libexec/imv-wayland "${@:-./}")}}		/usr/libexec/imv-wayland "${@:-./}"}}

	All done with a basic ~~bubblewrap~~ wrapper.		All done with a basic {{Ic\|bwrap}} wrapper.

	=== Seccomp ===		=== Seccomp ===

Encode: Add fallback for "$XDG_CACHE_HOME" & "$XDG_DATA_HOME".

2023-09-06T05:19:06Z

Add fallback for "$XDG_CACHE_HOME" & "$XDG_DATA_HOME".

← Older revision		Revision as of 05:19, 6 September 2023
Line 132:		Line 132:
	will still continue.		will still continue.

	Pass {{Path\|"$XDG_CONFIG_HOME"}} to ~~the~~ sandbox:		Pass {{Path\|"$XDG_CONFIG_HOME"}} to sandbox:
	--setenv XDG_CONFIG_HOME "$XDG_CONFIG_HOME" \		--setenv XDG_CONFIG_HOME "$XDG_CONFIG_HOME" \
	but this isn't always defined, so lets fallback to the		but this isn't always defined, so lets fallback to the
Line 268:		Line 268:
	--ro-bind /usr/share/fonts/ /usr/share/fonts/ \		--ro-bind /usr/share/fonts/ /usr/share/fonts/ \
	--ro-bind-try "${XDG_DATA_HOME}/fonts/" "${XDG_DATA_HOME}/fonts/" \		--ro-bind-try "${XDG_DATA_HOME}/fonts/" "${XDG_DATA_HOME}/fonts/" \
	~~Also need~~:		Pass {{Path\|"$XDG_DATA_HOME"}} to sandbox:
	--setenv XDG_DATA_HOME "$XDG_DATA_HOME" \		--setenv XDG_DATA_HOME "$XDG_DATA_HOME" \
			just like for {{Path\|"$XDG_CONFIG_HOME"}}, this isn't always defined, so
			fallback to
			[https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html XDG Base Directory]
			default:
			XDG_DATA_HOME="${XDG_DATA_HOME:=$HOME/.local/share}"
			use {{Path\|"$XDG_DATA_HOME"}} if set, else use {{Path\|"$HOME/.local/share"}}.

	The user cache of font information is also needed, by default		The user cache of font information is also needed, by default
Line 277:		Line 283:
	{{Note\|It seems to still work with {{Ic\|--ro-bind-try}}, does it not need to write to it?}}		{{Note\|It seems to still work with {{Ic\|--ro-bind-try}}, does it not need to write to it?}}

	~~Also need~~:		Pass {{Path\|"$XDG_CACHE_HOME"}} to sandbox:
	--setenv XDG_CACHE_HOME "$XDG_CACHE_HOME" \		--setenv XDG_CACHE_HOME "$XDG_CACHE_HOME" \
			just like for {{Path\|"$XDG_CONFIG_HOME"}}, this isn't always defined; so
			fallback to
			[https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html XDG Base Directory]
			default:
			XDG_CACHE_HOME="${XDG_CACHE_HOME:=$HOME/.cache}"
			use {{Path\|"$XDG_CACHE_HOME"}} if set, else use {{Path\|"$HOME/.cache"}}.

	--ro-bind /usr/share/icu/ /usr/share/icu/ \		--ro-bind /usr/share/icu/ /usr/share/icu/ \
Line 294:		Line 306:
	set -u		set -u

			XDG_CACHE_HOME{{=}}"${XDG_CACHE_HOME:{{=}}$HOME/.cache}"
	XDG_CONFIG_HOME{{=}}"${XDG_CONFIG_HOME:{{=}}$HOME/.config}"		XDG_CONFIG_HOME{{=}}"${XDG_CONFIG_HOME:{{=}}$HOME/.config}"
			XDG_DATA_HOME{{=}}"${XDG_DATA_HOME:{{=}}$HOME/.local/share}"

	/usr/bin/bwrap \		/usr/bin/bwrap \

Encode: Remove note about needing to pass the source for 'config' if it's a symbolic link. That does not appear to be needed.

2023-09-06T00:15:59Z

Remove note about needing to pass the source for 'config' if it's a symbolic link. That does not appear to be needed.

← Older revision		Revision as of 00:15, 6 September 2023
Line 140:		Line 140:
	this will use {{Path\|"$XDG_CONFIG_HOME"}} if it's set, otherwise		this will use {{Path\|"$XDG_CONFIG_HOME"}} if it's set, otherwise
	fallback to the default of {{Path\|"$HOME/.config"}}.		fallback to the default of {{Path\|"$HOME/.config"}}.

	{{Note\|If you have your imv config as a symbolic link, where it points to will also need to be added. Lets say you had a symbolic link that points to {{Path\|~/src/dots/imv/config}}, you would do: <br>
	~~<code>--ro-bind-try "${HOME}/src/dots/imv/config" "${HOME}/src/dots/imv/config" \</code> <br> <code>--ro-bind-try "${XDG_CONFIG_HOME}/imv/config" "${XDG_CONFIG_HOME}/imv/config" \</code>}}~~

	Also need:		Also need:

← Older revision		Revision as of 07:28, 24 May 2024
Line 14:		Line 14:
	== Installation ==		== Installation ==

	Install {{Pkg\|bubblewrap}}:		Install {{Pkg\|bubblewrap\|arch=}}:

	{{Cmd\|# apk add bubblewrap}}		{{Cmd\|# apk add bubblewrap}}

	{{Note\|The package is {{pkg\|bubblewrap}} but the command to		{{Note\|The package is {{pkg\|bubblewrap\|arch=}} but the command to
	manage it is {{Ic\|bwrap}}.}}		manage it is {{Ic\|bwrap}}.}}

Line 46:		Line 46:
	{{Note\|With how we will be sandboxing everything that doesn't match our owner/group will show as {{Ic\|nobody}}.}}		{{Note\|With how we will be sandboxing everything that doesn't match our owner/group will show as {{Ic\|nobody}}.}}

	Lets assume you want to sandbox {{Pkg\|imv}} and are using [[Wayland]]		Lets assume you want to sandbox {{Pkg\|imv\|arch=}} and are using [[Wayland]]
	only. Here is how you might go about that.		only. Here is how you might go about that.

Line 116:		Line 116:
	{{Note\|It is not worth the time to limit {{Path\|/usr/lib/*}}, the churn is too great.}}		{{Note\|It is not worth the time to limit {{Path\|/usr/lib/*}}, the churn is too great.}}

	{{Warning\|The {{Ic\|ldd}} manpage talks about some security implications. It may not apply since they seem to be talking about glibc and {{Pkg\|musl-utils}} makes {{Path\|/lib/ld-musl-x86_64.so.1}} ldd [https://git.alpinelinux.org/aports/tree/main/musl/APKBUILD#n105]. Is this something to worry about?}}		{{Warning\|The {{Ic\|ldd}} manpage talks about some security implications. It may not apply since they seem to be talking about glibc and {{Pkg\|musl-utils\|arch=}} makes {{Path\|/lib/ld-musl-x86_64.so.1}} ldd [https://git.alpinelinux.org/aports/tree/main/musl/APKBUILD#n105]. Is this something to worry about?}}

	Since this is a shell script, lets use a helpful command:		Since this is a shell script, lets use a helpful command:
Line 284:		Line 284:

	Look at the {{Ic\|fonts-conf}} manpage (which is from		Look at the {{Ic\|fonts-conf}} manpage (which is from
	{{Pkg\|fontconfig-doc}}) we see that {{Path\|/etc/fonts/}} is the system		{{Pkg\|fontconfig-doc\|arch=}}) we see that {{Path\|/etc/fonts/}} is the system
	font configuration directory and		font configuration directory and
	{{Path\|"${XDG_CONFIG_HOME}/fontconfig/"}} is the per-user configuration		{{Path\|"${XDG_CONFIG_HOME}/fontconfig/"}} is the per-user configuration
Line 422:		Line 422:
	{{Obsolete\|This should probably be documented in [[Default_applications]] and linked here. Nothing is unique in using with {{Ic\|bwrap}}.}}		{{Obsolete\|This should probably be documented in [[Default_applications]] and linked here. Nothing is unique in using with {{Ic\|bwrap}}.}}

	{{Note\|This section is also using {{Pkg\|imv}} as the example.}}		{{Note\|This section is also using {{Pkg\|imv\|arch=}} as the example.}}

	[https://specifications.freedesktop.org/desktop-entry-spec/desktop-entry-spec-latest.html XDG Desktop Entry Specification]		[https://specifications.freedesktop.org/desktop-entry-spec/desktop-entry-spec-latest.html XDG Desktop Entry Specification]
Line 442:		Line 442:
	</nowiki>...}}		</nowiki>...}}

	The program {{Ic\|xdg-open}} (from the {{Pkg\|xdg-utils}} package) can be		The program {{Ic\|xdg-open}} (from the {{Pkg\|xdg-utils\|arch=}} package) can be
	used to open files based on the [https://en.wikipedia.org/wiki/MIME MIME]		used to open files based on the [https://en.wikipedia.org/wiki/MIME MIME]
	type + corresponding entry in		type + corresponding entry in
Line 448:		Line 448:
	{{Path\|"${XDG_DATA_HOME}/applications/mimeinfo.cache"}}.		{{Path\|"${XDG_DATA_HOME}/applications/mimeinfo.cache"}}.

	Install {{Pkg\|desktop-file-utils}} if it is not installed already, it		Install {{Pkg\|desktop-file-utils\|arch=}} if it is not installed already, it
	comes with two commands that are needed {{Ic\|desktop-file-validate}} and		comes with two commands that are needed {{Ic\|desktop-file-validate}} and
	{{Ic\|update-desktop-database}}:		{{Ic\|update-desktop-database}}:

← Older revision		Revision as of 11:00, 17 November 2023
Line 18:		Line 18:
	{{Cmd\|# apk add bubblewrap}}		{{Cmd\|# apk add bubblewrap}}

	{{Note\|The package is {{Ic\|bubblewrap}} but the command to		{{Note\|The package is {{pkg\|bubblewrap}} but the command to
	manage it is {{Ic\|bwrap}}.}}		manage it is {{Ic\|bwrap}}.}}