Bubblewrap/Examples - Revision history

Encode: *: Separate shell command short options that don't take input from ones that do, I think it adds clarity

2025-03-18T23:02:27Z

*: Separate shell command short options that don't take input from ones that do, I think it adds clarity

← Older revision		Revision as of 23:02, 18 March 2025
Line 29:		Line 29:
	NEW_XDG_CACHE_HOME{{=}}"${NEW_HOME}${XDG_CACHE_HOME#"$HOME"}"		NEW_XDG_CACHE_HOME{{=}}"${NEW_HOME}${XDG_CACHE_HOME#"$HOME"}"

	mkdir -pm 0700 "${XDG_DATA_HOME}/firefox/"		mkdir -p -m 0700 "${XDG_DATA_HOME}/firefox/"

	/usr/bin/bwrap \		/usr/bin/bwrap \
Line 80:		Line 80:
	{{Path\|"$XDG_CACHE_HOME"}} for the new user.		{{Path\|"$XDG_CACHE_HOME"}} for the new user.

	mkdir -pm 0700 "${XDG_DATA_HOME}/firefox/"		mkdir -p -m 0700 "${XDG_DATA_HOME}/firefox/"
	Make sure the new (real) home for Firefox data exist.		Make sure the new (real) home for Firefox data exist.

Line 398:		Line 398:
	NEW_PASSWORD_DATABASE{{=}}"${NEW_HOME}${PASSWORD_DATABASE#"$HOME"}"		NEW_PASSWORD_DATABASE{{=}}"${NEW_HOME}${PASSWORD_DATABASE#"$HOME"}"

	mkdir -pm 0700 "$PASSWORD_DATABASE"		mkdir -p -m 0700 "$PASSWORD_DATABASE"

	/usr/bin/bwrap \		/usr/bin/bwrap \
Line 628:		Line 628:
	'''NEW_XDG_DATA_HOME="${NEW_HOME}${XDG_DATA_HOME#"$HOME"}"'''		'''NEW_XDG_DATA_HOME="${NEW_HOME}${XDG_DATA_HOME#"$HOME"}"'''

	'''mkdir -pm 0700 "${XDG_DATA_HOME}/mpv/"'''		'''mkdir -p -m 0700 "${XDG_DATA_HOME}/mpv/"'''

	...		...
Line 642:		Line 642:

	{{Cat\|"${XDG_CONFIG_HOME}/mpv/mpv.conf"\|<nowiki>...		{{Cat\|"${XDG_CONFIG_HOME}/mpv/mpv.conf"\|<nowiki>...
	# Something like this, change to match "$XDG_DATA_HOME"		# Something like this, change to match your "$XDG_DATA_HOME"
	screenshot-template="~/.local/share/mpv/screenshots/%F [%p] %02n"		screenshot-template="~/.local/share/mpv/screenshots/%F [%p] %02n"
	...</nowiki>}}		...</nowiki>}}
Line 659:		Line 659:
	NEW_XDG_CONFIG_HOME{{=}}"${NEW_HOME}${XDG_CONFIG_HOME#"$HOME"}"		NEW_XDG_CONFIG_HOME{{=}}"${NEW_HOME}${XDG_CONFIG_HOME#"$HOME"}"

	mkdir -pm 0700 "${HOME}/Downloads/"		mkdir -p -m 0700 "${HOME}/Downloads/"

	/usr/bin/bwrap \		/usr/bin/bwrap \
Line 713:		Line 713:
	XDG_DATA_HOME{{=}}"${XDG_DATA_HOME:-$HOME/.local/share}"		XDG_DATA_HOME{{=}}"${XDG_DATA_HOME:-$HOME/.local/share}"

	mkdir -pm 0700 "${XDG_DATA_HOME}/zathura/"		mkdir -p -m 0700 "${XDG_DATA_HOME}/zathura/"

	/usr/bin/bwrap \		/usr/bin/bwrap \
Line 741:		Line 741:
	/usr/bin/zathura "$1"}}		/usr/bin/zathura "$1"}}

	mkdir -pm 0700 "${XDG_DATA_HOME}/zathura/"		mkdir -p -m 0700 "${XDG_DATA_HOME}/zathura/"
	Have to premake the directory for {{Ic\|zathura}} data.		Have to premake the directory for {{Ic\|zathura}} data.

Encode: Firefox: allow policies, if found

2025-03-18T22:50:59Z

Firefox: allow policies, if found

← Older revision		Revision as of 22:50, 18 March 2025
Line 43:		Line 43:
	--hostname localhost \		--hostname localhost \
	--dev /dev/ \		--dev /dev/ \
			--ro-bind-try /etc/firefox/policies/policies.json /etc/firefox/policies/policies.json \
	--ro-bind /etc/fonts/ /etc/fonts/ \		--ro-bind /etc/fonts/ /etc/fonts/ \
	--ro-bind /etc/resolv.conf /etc/resolv.conf \		--ro-bind /etc/resolv.conf /etc/resolv.conf \
Line 114:		Line 115:
	--dev /dev/ \		--dev /dev/ \
	New devtmpfs, access to special or device files.		New devtmpfs, access to special or device files.

			--ro-bind-try /etc/firefox/policies/policies.json /etc/firefox/policies/policies.json \
			Set Firefox [https://mozilla.github.io/policy-templates/ policies], if found.

	--ro-bind /etc/fonts/ /etc/fonts/ \		--ro-bind /etc/fonts/ /etc/fonts/ \

Encode: Use default values, instead of assign default values. Doesn't matter in this situation, but will lead to surprising results in most situations.

2024-06-05T03:06:03Z

Use default values, instead of assign default values. Doesn't matter in this situation, but will lead to surprising results in most situations.

← Older revision		Revision as of 03:06, 5 June 2024
Line 23:		Line 23:
	set -u		set -u

	XDG_CACHE_HOME{{=}}"${XDG_CACHE_HOME:~~{{=}}~~$HOME/.cache}"		XDG_CACHE_HOME{{=}}"${XDG_CACHE_HOME:-$HOME/.cache}"
	XDG_DATA_HOME{{=}}"${XDG_DATA_HOME:~~{{=}}~~$HOME/.local/share}"		XDG_DATA_HOME{{=}}"${XDG_DATA_HOME:-$HOME/.local/share}"

	NEW_HOME{{=}}'/home/user'		NEW_HOME{{=}}'/home/user'
Line 69:		Line 69:
	few exceptions).		few exceptions).

	XDG_CACHE_HOME="${XDG_CACHE_HOME:=$HOME/.cache}"		XDG_CACHE_HOME="${XDG_CACHE_HOME:-$HOME/.cache}"
	XDG_DATA_HOME="${XDG_DATA_HOME:=$HOME/.local/share}"		XDG_DATA_HOME="${XDG_DATA_HOME:-$HOME/.local/share}"
	Take value if already set, else fallback to the [https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html XDG] default.		Take value if already set, else fallback to the [https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html XDG] default.

Line 125:		Line 125:

	...		...
	XDG_CACHE_HOME="${XDG_CACHE_HOME:=$HOME/.cache}"		XDG_CACHE_HOME="${XDG_CACHE_HOME:-$HOME/.cache}"
	'''XDG_CONFIG_HOME "${XDG_CONFIG_HOME:=$HOME/.config}"'''		'''XDG_CONFIG_HOME "${XDG_CONFIG_HOME:-$HOME/.config}"'''
	XDG_DATA_HOME="${XDG_DATA_HOME:=$HOME/.local/share}"		XDG_DATA_HOME="${XDG_DATA_HOME:-$HOME/.local/share}"
	...		...
	NEW_XDG_CACHE_HOME="${NEW_HOME}${XDG_CACHE_HOME#"$HOME"}"		NEW_XDG_CACHE_HOME="${NEW_HOME}${XDG_CACHE_HOME#"$HOME"}"
Line 144:		Line 144:

	...		...
	XDG_CACHE_HOME="${XDG_CACHE_HOME:=$HOME/.cache}"		XDG_CACHE_HOME="${XDG_CACHE_HOME:-$HOME/.cache}"
	'''XDG_CONFIG_HOME "${XDG_CONFIG_HOME:=$HOME/.config}"'''		'''XDG_CONFIG_HOME "${XDG_CONFIG_HOME:-$HOME/.config}"'''
	XDG_DATA_HOME="${XDG_DATA_HOME:=$HOME/.local/share}"		XDG_DATA_HOME="${XDG_DATA_HOME:-$HOME/.local/share}"
	...		...
	NEW_XDG_CACHE_HOME="${NEW_HOME}${XDG_CACHE_HOME#"$HOME"}"		NEW_XDG_CACHE_HOME="${NEW_HOME}${XDG_CACHE_HOME#"$HOME"}"
Line 306:		Line 306:
	set -u		set -u

	XDG_CONFIG_HOME{{=}}"${XDG_CONFIG_HOME:~~{{=}}~~$HOME/.config}"		XDG_CONFIG_HOME{{=}}"${XDG_CONFIG_HOME:-$HOME/.config}"

	/usr/bin/bwrap \		/usr/bin/bwrap \
Line 338:		Line 338:
	...		...

	'''XDG_CACHE_HOME{{=}}"${XDG_CACHE_HOME:~~{{=}}~~$HOME/.cache}"'''		'''XDG_CACHE_HOME{{=}}"${XDG_CACHE_HOME:-$HOME/.cache}"'''
	XDG_CONFIG_HOME{{=}}"${XDG_CONFIG_HOME:~~{{=}}~~$HOME/.config}"		XDG_CONFIG_HOME{{=}}"${XDG_CONFIG_HOME:-$HOME/.config}"
	'''XDG_DATA_HOME{{=}}"${XDG_DATA_HOME:~~{{=}}~~$HOME/.local/share}"'''		'''XDG_DATA_HOME{{=}}"${XDG_DATA_HOME:-$HOME/.local/share}"'''

	...		...
Line 387:		Line 387:
	set -u		set -u

	XDG_CONFIG_HOME{{=}}"${XDG_CONFIG_HOME:~~{{=}}~~$HOME/.config}"		XDG_CONFIG_HOME{{=}}"${XDG_CONFIG_HOME:-$HOME/.config}"
	PASSWORD_DATABASE{{=}}"${HOME}/password database"		PASSWORD_DATABASE{{=}}"${HOME}/password database"

Line 459:		Line 459:
	fi		fi

	XDG_CACHE_HOME{{=}}"${XDG_CACHE_HOME:~~{{=}}~~$HOME/.cache}"		XDG_CACHE_HOME{{=}}"${XDG_CACHE_HOME:-$HOME/.cache}"
	XDG_CONFIG_HOME{{=}}"${XDG_CONFIG_HOME:~~{{=}}~~$HOME/.config}"		XDG_CONFIG_HOME{{=}}"${XDG_CONFIG_HOME:-$HOME/.config}"

	NEW_HOME{{=}}'/home/user'		NEW_HOME{{=}}'/home/user'
Line 536:		Line 536:
	set -u		set -u

	XDG_CACHE_HOME{{=}}"${XDG_CACHE_HOME:~~{{=}}~~$HOME/.cache}"		XDG_CACHE_HOME{{=}}"${XDG_CACHE_HOME:-$HOME/.cache}"
	XDG_CONFIG_HOME{{=}}"${XDG_CONFIG_HOME:~~{{=}}~~$HOME/.config}"		XDG_CONFIG_HOME{{=}}"${XDG_CONFIG_HOME:-$HOME/.config}"

	NEW_HOME{{=}}'/home/user'		NEW_HOME{{=}}'/home/user'
Line 617:		Line 617:

	...		...
	XDG_CONFIG_HOME="${XDG_CONFIG_HOME:=$HOME/.config}"		XDG_CONFIG_HOME="${XDG_CONFIG_HOME:-$HOME/.config}"
	'''XDG_DATA_HOME="${XDG_DATA_HOME:=$HOME/.local/share}"'''		'''XDG_DATA_HOME="${XDG_DATA_HOME:-$HOME/.local/share}"'''

	...		...
Line 650:		Line 650:
	set -u		set -u

	XDG_CONFIG_HOME{{=}}"${XDG_CONFIG_HOME:~~{{=}}~~$HOME/.config}"		XDG_CONFIG_HOME{{=}}"${XDG_CONFIG_HOME:-$HOME/.config}"

	NEW_HOME{{=}}'/home/user'		NEW_HOME{{=}}'/home/user'
Line 706:		Line 706:
	fi		fi

	XDG_CONFIG_HOME{{=}}"${XDG_CONFIG_HOME:~~{{=}}~~$HOME/.config}"		XDG_CONFIG_HOME{{=}}"${XDG_CONFIG_HOME:-$HOME/.config}"
	XDG_DATA_HOME{{=}}"${XDG_DATA_HOME:~~{{=}}~~$HOME/.local/share}"		XDG_DATA_HOME{{=}}"${XDG_DATA_HOME:-$HOME/.local/share}"

	mkdir -pm 0700 "${XDG_DATA_HOME}/zathura/"		mkdir -pm 0700 "${XDG_DATA_HOME}/zathura/"

Encode: Pkg: Search every arch

2024-05-24T07:24:12Z

Pkg: Search every arch

← Older revision		Revision as of 07:24, 24 May 2024
Line 5:		Line 5:
	* {{Ic\|imv}}, {{Ic\|mpv}} and {{Ic\|zathura}} currently only accept 1 mandatory (except {{Ic\|imv}}) argument. This should (hopefully) be temporary, until I figure out how to pass multiple arguments (without including everything else).}}		* {{Ic\|imv}}, {{Ic\|mpv}} and {{Ic\|zathura}} currently only accept 1 mandatory (except {{Ic\|imv}}) argument. This should (hopefully) be temporary, until I figure out how to pass multiple arguments (without including everything else).}}

	{{Warning\|These were found by going backward; start with a complicated program and as restricted as possible sandbox, allowing more till the program appears to work. Because of this, complicated and sensitive programs (for example: {{Pkg\|firefox}} and {{Pkg\|keepassxc}}) may be missing some things they need, which might lead to '''LESS SECURITY''', '''LESS PRIVACY''' and '''DATA LOSS'''.}}		{{Warning\|These were found by going backward; start with a complicated program and as restricted as possible sandbox, allowing more till the program appears to work. Because of this, complicated and sensitive programs (for example: {{Pkg\|firefox\|arch=}} and {{Pkg\|keepassxc\|arch=}}) may be missing some things they need, which might lead to '''LESS SECURITY''', '''LESS PRIVACY''' and '''DATA LOSS'''.}}

	{{Note\|		{{Note\|
Line 426:		Line 426:

	PASSWORD_DATABASE="${HOME}/password database"		PASSWORD_DATABASE="${HOME}/password database"
	Directory containing your {{Pkg\|keepassxc}} password database.		Directory containing your {{Pkg\|keepassxc\|arch=}} password database.

	{{Tip\|This is almost certainly not where '''your''' database is located. You will need to change it to where you put your password database.}}		{{Tip\|This is almost certainly not where '''your''' database is located. You will need to change it to where you put your password database.}}

Encode: Update formatting

2024-05-24T07:09:55Z

Update formatting

Show changes

Encode: Add a general warning about potential problems from using stuff from here

2024-05-21T06:34:52Z

Add a general warning about potential problems from using stuff from here

← Older revision		Revision as of 06:34, 21 May 2024
Line 2:		Line 2:

	{{Todo\|Since bubblewrap can make use of [https://en.wikipedia.org/wiki/Seccomp seccomp], restrictive versions should be added. {{Ic\|imv}}, {{Ic\|mpv}} and {{Ic\|zathura}} currently only accept 1 mandatory (except {{Ic\|imv}}) argument. This should (hopefully) be temporary, until I figure out how to pass multiple arguments (without including everything else).}}		{{Todo\|Since bubblewrap can make use of [https://en.wikipedia.org/wiki/Seccomp seccomp], restrictive versions should be added. {{Ic\|imv}}, {{Ic\|mpv}} and {{Ic\|zathura}} currently only accept 1 mandatory (except {{Ic\|imv}}) argument. This should (hopefully) be temporary, until I figure out how to pass multiple arguments (without including everything else).}}

			{{Warning\|These were found by going backward; start with a complicated program and as restricted as possible sandbox, allowing more till the program appears to work. Because of this, complicated and sensitive programs (for example: {{Pkg\|firefox}} and {{Pkg\|keepassxc}}) may be missing some things they need, which might lead to '''LESS SECURITY''', '''LESS PRIVACY''' and '''DATA LOSS'''.}}

	{{Note\|This page assumes you have already read over [[Bubblewrap]]. To try and avoid duplicates, everything will be explained for [[Firefox]] and only when it differs (non obviously) for everything else. Where applicable this also assumes: [[Wayland]] only + [[PipeWire]]. If you use Wayland, make sure you have dealt with [[Wayland#XDG_RUNTIME_DIR\|XDG_RUNTIME_DIR]].}}		{{Note\|This page assumes you have already read over [[Bubblewrap]]. To try and avoid duplicates, everything will be explained for [[Firefox]] and only when it differs (non obviously) for everything else. Where applicable this also assumes: [[Wayland]] only + [[PipeWire]]. If you use Wayland, make sure you have dealt with [[Wayland#XDG_RUNTIME_DIR\|XDG_RUNTIME_DIR]].}}

Encode: KeePassXC example

2024-05-21T05:19:22Z

KeePassXC example

← Older revision		Revision as of 05:19, 21 May 2024
Line 363:		Line 363:

	{{Warning\|If you don't pass anything and it defaults to the current directory, it will have '''everything''' under that directory shown to {{Ic\|imv}}, recursively.}}		{{Warning\|If you don't pass anything and it defaults to the current directory, it will have '''everything''' under that directory shown to {{Ic\|imv}}, recursively.}}

			== KeePassXC ==

			{{Note\|I only use the bare minimum functionality, so functionality you need is probably missing. If you use functionality not here, your contribution will be most appreciated. To kick things off: {{Ic\|Unable to initialize libusb. USB devices may not be detected properly.}} can be silenced with {{Ic\|--dev-bind /dev/bus/usb/ /dev/bus/usb/ \}}.}}

			{{Cat\|~/.local/bin/bwrap-keepassxc\|#!/bin/sh

			# keepassxc wrapped in bwrap.

			set -u

			XDG_CONFIG_HOME{{=}}"${XDG_CONFIG_HOME:{{=}}$HOME/.config}"
			PASSWORD_DATABASE{{=}}"${HOME}/password database"

			NEW_HOME{{=}}'/home/user'
			NEW_XDG_CONFIG_HOME{{=}}"${NEW_HOME}${XDG_CONFIG_HOME#"$HOME"}"
			NEW_PASSWORD_DATABASE{{=}}"${NEW_HOME}${PASSWORD_DATABASE#"$HOME"}"

			mkdir -pm 0700 "$PASSWORD_DATABASE"

			/usr/bin/bwrap \
			--unshare-all \
			--new-session \
			--die-with-parent \
			--clearenv \
			--setenv HOME "$NEW_HOME" \
			--setenv WAYLAND_DISPLAY "$WAYLAND_DISPLAY" \
			--setenv XDG_CONFIG_HOME "$NEW_XDG_CONFIG_HOME" \
			--setenv XDG_RUNTIME_DIR "$XDG_RUNTIME_DIR" \
			--setenv XDG_SESSION_TYPE "$XDG_SESSION_TYPE" \
			--dev-bind /dev/dri/renderD128 /dev/dri/renderD128 \
			--ro-bind /etc/fonts/ /etc/fonts/ \
			--bind-try "${XDG_CONFIG_HOME}/keepassxc/" "${NEW_XDG_CONFIG_HOME}/keepassxc/" \
			--ro-bind /lib/ld-musl-x86_64.so.1 /lib/ld-musl-x86_64.so.1 \
			--ro-bind /lib/libcrypto.so.3 /lib/libcrypto.so.3 \
			--ro-bind /lib/libssl.so.3 /lib/libssl.so.3 \
			--ro-bind /lib/libz.so.1 /lib/libz.so.1 \
			--ro-bind "${XDG_RUNTIME_DIR}/${WAYLAND_DISPLAY}" "${XDG_RUNTIME_DIR}/${WAYLAND_DISPLAY}" \
			--ro-bind /sys/dev/char/ /sys/dev/char/ \
			--ro-bind /sys/devices/pci0000:00/ /sys/devices/pci0000:00/ \
			--ro-bind /usr/bin/keepassxc /usr/bin/keepassxc \
			--ro-bind /usr/lib/ /usr/lib/ \
			--ro-bind /usr/share/X11/ /usr/share/X11/ \
			--ro-bind /usr/share/fontconfig/ /usr/share/fontconfig/ \
			--ro-bind /usr/share/fonts/ /usr/share/fonts/ \
			--ro-bind /usr/share/keepassxc/ /usr/share/keepassxc/ \
			--bind "$PASSWORD_DATABASE/" "$NEW_PASSWORD_DATABASE/" \
			/usr/bin/keepassxc "$@"}}

			PASSWORD_DATABASE="${HOME}/password database"
			Directory containing your {{Pkg\|keepassxc}} password database.

			{{Tip\|This is almost certainly not where '''your''' database is located. You will need to change it to where you put your password database.}}

			--setenv XDG_SESSION_TYPE "$XDG_SESSION_TYPE" \
			Session type, since we are assuming Wayland only, this will be "wayland".

			--ro-bind /sys/dev/char/ /sys/dev/char/ \
			Access to character devices.

			--ro-bind /sys/devices/pci0000:00/ /sys/devices/pci0000:00/ \
			Access to PCI resources.

			--bind "$PASSWORD_DATABASE/" "$NEW_PASSWORD_DATABASE/" \
			Bind password database.

	== mpv ==		== mpv ==

Encode: env isn't necessary

2024-05-20T23:02:53Z

env isn't necessary

← Older revision		Revision as of 23:02, 20 May 2024
Line 9:		Line 9:
	== Firefox ==		== Firefox ==

	{{Cat\|~/.local/bin/bwrap-firefox\|#!~~/usr~~/bin/~~env~~ sh		{{Cat\|~/.local/bin/bwrap-firefox\|#!/bin/sh

	# Firefox wrapped in bwrap with network access.		# Firefox wrapped in bwrap with network access.
Line 289:		Line 289:
	== imv ==		== imv ==

	{{Cat\|~/.local/bin/bwrap-imv\|#!~~/usr~~/bin/~~env~~ sh		{{Cat\|~/.local/bin/bwrap-imv\|#!/bin/sh

	# imv wrapped in bwrap.		# imv wrapped in bwrap.
Line 366:		Line 366:
	== mpv ==		== mpv ==

	{{Cat\|~/.local/bin/bwrap-mpv\|#!~~/usr~~/bin/~~env~~ sh		{{Cat\|~/.local/bin/bwrap-mpv\|#!/bin/sh

	# mpv wrapped in bwrap.		# mpv wrapped in bwrap.
Line 452:		Line 452:
	{{Tip\|You can use both {{Ic\|bwrap-mpv}} and {{Ic\|bwrap-mpv-net}}. {{Ic\|bwrap-mpv}} for local stuff and {{Ic\|bwrap-mpv-net}} for watching over the Internet.}}		{{Tip\|You can use both {{Ic\|bwrap-mpv}} and {{Ic\|bwrap-mpv-net}}. {{Ic\|bwrap-mpv}} for local stuff and {{Ic\|bwrap-mpv-net}} for watching over the Internet.}}

	{{Cat\|~/.local/bin/bwrap-mpv-net\|#!~~/usr~~/bin/~~env~~ sh		{{Cat\|~/.local/bin/bwrap-mpv-net\|#!/bin/sh

	# mpv wrapped in bwrap with network access.		# mpv wrapped in bwrap with network access.
Line 564:		Line 564:
	== yt-dlp ==		== yt-dlp ==

	{{Cat\|~/.local/bin/bwrap-yt-dlp\|#!~~/usr~~/bin/~~env~~ sh		{{Cat\|~/.local/bin/bwrap-yt-dlp\|#!/bin/sh

	# yt-dlp wrapped in bwrap with network access.		# yt-dlp wrapped in bwrap with network access.
Line 611:		Line 611:
	== zathura ==		== zathura ==

	{{Cat\|~/.local/bin/bwrap-zathura\|#!~~/usr~~/bin/~~env~~ sh		{{Cat\|~/.local/bin/bwrap-zathura\|#!/bin/sh

	# zathura wrapped in bwrap.		# zathura wrapped in bwrap.

Encode: More crypto

2024-01-12T03:46:16Z

More crypto

← Older revision		Revision as of 03:46, 12 January 2024
Line 42:		Line 42:
	--ro-bind /lib/ld-musl-x86_64.so.1 /lib/ld-musl-x86_64.so.1 \		--ro-bind /lib/ld-musl-x86_64.so.1 /lib/ld-musl-x86_64.so.1 \
	--ro-bind /lib/libblkid.so.1 /lib/libblkid.so.1 \		--ro-bind /lib/libblkid.so.1 /lib/libblkid.so.1 \
			--ro-bind /lib/libcrypto.so.3 /lib/libcrypto.so.3 \
	--ro-bind /lib/libmount.so.1 /lib/libmount.so.1 \		--ro-bind /lib/libmount.so.1 /lib/libmount.so.1 \
	--ro-bind /lib/libz.so.1 /lib/libz.so.1 \		--ro-bind /lib/libz.so.1 /lib/libz.so.1 \
Line 186:		Line 187:
	--ro-bind /lib/ld-musl-x86_64.so.1 /lib/ld-musl-x86_64.so.1 \		--ro-bind /lib/ld-musl-x86_64.so.1 /lib/ld-musl-x86_64.so.1 \
	--ro-bind /lib/libblkid.so.1 /lib/libblkid.so.1 \		--ro-bind /lib/libblkid.so.1 /lib/libblkid.so.1 \
			--ro-bind /lib/libcrypto.so.3 /lib/libcrypto.so.3 \
	--ro-bind /lib/libmount.so.1 /lib/libmount.so.1 \		--ro-bind /lib/libmount.so.1 /lib/libmount.so.1 \
	--ro-bind /lib/libz.so.1 /lib/libz.so.1 \		--ro-bind /lib/libz.so.1 /lib/libz.so.1 \

Encode: Add documentation and combine some existing.

2023-11-14T07:29:35Z

Add documentation and combine some existing.

← Older revision		Revision as of 07:29, 14 November 2023
Line 1:		Line 1:
	{{Draft\|Someone more experienced needs to look over this.}}		{{Draft\|Someone more experienced needs to look over this.}}

	{{Todo\|Since bubblewrap can make use of [https://en.wikipedia.org/wiki/Seccomp seccomp], restrictive versions should be added.}}		{{Todo\|Since bubblewrap can make use of [https://en.wikipedia.org/wiki/Seccomp seccomp], restrictive versions should be added. {{Ic\|imv}}, {{Ic\|mpv}} and {{Ic\|zathura}} currently only accept 1 mandatory (except {{Ic\|imv}}) argument. This should (hopefully) be temporary, until I figure out how to pass multiple arguments (without including everything else).}}

	{{Note\|This page assumes you have already read over [[Bubblewrap]]. To try and avoid duplicates, everything will be explained for [[Firefox]] and only when it differs (non obviously) for everything else. Where applicable this also assumes: [[Wayland]] only + [[PipeWire]].}}		{{Note\|This page assumes you have already read over [[Bubblewrap]]. To try and avoid duplicates, everything will be explained for [[Firefox]] and only when it differs (non obviously) for everything else. Where applicable this also assumes: [[Wayland]] only + [[PipeWire]]. If you use Wayland, make sure you have dealt with [[Wayland#XDG_RUNTIME_DIR\|XDG_RUNTIME_DIR]].}}

	~~{{Note\|{{Ic\|imv}}, {{Ic\|mpv}} and {{Ic\|zathura}} currently only accept 1 (mandatory~~, ~~except {{Ic~~\|~~imv}}) argument. This should (hopefully) be temporary, until I figure out how to pass multiple arguments (without including everything else)~~.}}

	{{TOC right}}		{{TOC right}}
Line 350:		Line 348:
	...		...
	(Optional) To use commands in {{Ic\|imv}}.		(Optional) To use commands in {{Ic\|imv}}.

			--ro-bind /sys/dev/char/ /sys/dev/char/ \
			Access to character devices.

			--ro-bind /sys/devices/pci0000:00/ /sys/devices/pci0000:00/ \
			Access to PCI resources.

	--ro-bind "${1:-./}" "$(realpath "${1:-./}")" \		--ro-bind "${1:-./}" "$(realpath "${1:-./}")" \
	Get the absolute pathname using {{Ic\|realpath}}, so you can pass a		Get the absolute pathname using {{Ic\|realpath}}, so you can pass a
	relative argument and still bind the argument. If you don't pass in		relative argument and still bind the argument. If you don't pass in
	anything it will default to {{Ic\|./}}, the current directory.		anything it will default to {{Path\|./}}, the current directory.

	{{Warning\|If you don't pass anything and it defaults to the current directory, it will have '''everything''' under that directory shown to {{Ic\|imv}}, recursively.}}		{{Warning\|If you don't pass anything and it defaults to the current directory, it will have '''everything''' under that directory shown to {{Ic\|imv}}, recursively.}}
Line 419:		Line 423:
	--title{{=}}'bwrap {{!}} ${media-title}' \		--title{{=}}'bwrap {{!}} ${media-title}' \
	"$1"}}		"$1"}}

			--ro-bind /sys/dev/char/ /sys/dev/char/ \
			Access to character devices.

			--ro-bind /sys/devices/pci0000:00/ /sys/devices/pci0000:00/ \
			Access to PCI resources.

	--ro-bind "$1" "$(realpath "$1")" \		--ro-bind "$1" "$(realpath "$1")" \
Line 502:		Line 512:
	--ro-bind /etc/ssl/certs/ /etc/ssl/certs/ \		--ro-bind /etc/ssl/certs/ /etc/ssl/certs/ \
	Certificate authorities that are ''trusted''.		Certificate authorities that are ''trusted''.

			--ro-bind /sys/dev/char/ /sys/dev/char/ \
			Access to character devices.

			--ro-bind /sys/devices/pci0000:00/ /sys/devices/pci0000:00/ \
			Access to PCI resources.

	"$@"		"$@"

← Older revision		Revision as of 07:24, 24 May 2024
Line 5:		Line 5:
	* {{Ic\|imv}}, {{Ic\|mpv}} and {{Ic\|zathura}} currently only accept 1 mandatory (except {{Ic\|imv}}) argument. This should (hopefully) be temporary, until I figure out how to pass multiple arguments (without including everything else).}}		* {{Ic\|imv}}, {{Ic\|mpv}} and {{Ic\|zathura}} currently only accept 1 mandatory (except {{Ic\|imv}}) argument. This should (hopefully) be temporary, until I figure out how to pass multiple arguments (without including everything else).}}

	{{Warning\|These were found by going backward; start with a complicated program and as restricted as possible sandbox, allowing more till the program appears to work. Because of this, complicated and sensitive programs (for example: {{Pkg\|firefox}} and {{Pkg\|keepassxc}}) may be missing some things they need, which might lead to '''LESS SECURITY''', '''LESS PRIVACY''' and '''DATA LOSS'''.}}		{{Warning\|These were found by going backward; start with a complicated program and as restricted as possible sandbox, allowing more till the program appears to work. Because of this, complicated and sensitive programs (for example: {{Pkg\|firefox\|arch=}} and {{Pkg\|keepassxc\|arch=}}) may be missing some things they need, which might lead to '''LESS SECURITY''', '''LESS PRIVACY''' and '''DATA LOSS'''.}}

	{{Note\|		{{Note\|
Line 426:		Line 426:

	PASSWORD_DATABASE="${HOME}/password database"		PASSWORD_DATABASE="${HOME}/password database"
	Directory containing your {{Pkg\|keepassxc}} password database.		Directory containing your {{Pkg\|keepassxc\|arch=}} password database.

	{{Tip\|This is almost certainly not where '''your''' database is located. You will need to change it to where you put your password database.}}		{{Tip\|This is almost certainly not where '''your''' database is located. You will need to change it to where you put your password database.}}

← Older revision		Revision as of 06:34, 21 May 2024
Line 2:		Line 2:

	{{Todo\|Since bubblewrap can make use of [https://en.wikipedia.org/wiki/Seccomp seccomp], restrictive versions should be added. {{Ic\|imv}}, {{Ic\|mpv}} and {{Ic\|zathura}} currently only accept 1 mandatory (except {{Ic\|imv}}) argument. This should (hopefully) be temporary, until I figure out how to pass multiple arguments (without including everything else).}}		{{Todo\|Since bubblewrap can make use of [https://en.wikipedia.org/wiki/Seccomp seccomp], restrictive versions should be added. {{Ic\|imv}}, {{Ic\|mpv}} and {{Ic\|zathura}} currently only accept 1 mandatory (except {{Ic\|imv}}) argument. This should (hopefully) be temporary, until I figure out how to pass multiple arguments (without including everything else).}}

			{{Warning\|These were found by going backward; start with a complicated program and as restricted as possible sandbox, allowing more till the program appears to work. Because of this, complicated and sensitive programs (for example: {{Pkg\|firefox}} and {{Pkg\|keepassxc}}) may be missing some things they need, which might lead to '''LESS SECURITY''', '''LESS PRIVACY''' and '''DATA LOSS'''.}}

	{{Note\|This page assumes you have already read over [[Bubblewrap]]. To try and avoid duplicates, everything will be explained for [[Firefox]] and only when it differs (non obviously) for everything else. Where applicable this also assumes: [[Wayland]] only + [[PipeWire]]. If you use Wayland, make sure you have dealt with [[Wayland#XDG_RUNTIME_DIR\|XDG_RUNTIME_DIR]].}}		{{Note\|This page assumes you have already read over [[Bubblewrap]]. To try and avoid duplicates, everything will be explained for [[Firefox]] and only when it differs (non obviously) for everything else. Where applicable this also assumes: [[Wayland]] only + [[PipeWire]]. If you use Wayland, make sure you have dealt with [[Wayland#XDG_RUNTIME_DIR\|XDG_RUNTIME_DIR]].}}