I want to sandbox things like Steam, Discord and even firefox and I see bubblwrap getting recommended a lot as the preferred sandboxing tool but I’m hardpressed on how to actually use it. I don’t know what to enable and what not to.

PS. Please don’t recommend Flatpak, I’m aware Flatpak uses bwrap but I want to avoid Flatpak unless absolute necessary. I don’t have anything against Flatpak, just personal preference :D.

  • patatahooligan@lemmy.world
    link
    fedilink
    English
    arrow-up
    2
    ·
    1 year ago

    From what I understand, bubblewrap is supposed be configured by passing flags from the command line. It seems that the way to “configure” bubblewrap is to create wrapper scripts. For example make /usr/local/bin with the following contents

    #!/usr/bin/bash
    bwrap --flags-and "arguments" steam
    

    As it’s not very practical to figure out a good sandbox from scratch for each and every program you use, you probably want to find scripts from other users or tools that build on top of bubblewrap and are bundled with profiles. The wiki article has examples of both.

  • 𝖕𝖘𝖊𝖚𝖉@lemmy.world
    link
    fedilink
    English
    arrow-up
    1
    ·
    1 year ago

    Here’s how I run Firefox, for instance:

    #!/bin/zsh
    
    function r { for p in $@; do [[ -e $p ]] && echo --ro-bind-try $p $p; done; }
    function w { for p in $@; do [[ -e $p ]] && echo --bind-try $p $p; done; }
    function ln { echo --symlink $1 $2; }
    function wdev { for p in $@; do echo --dev-bind-try $p $p; done; }
    
    bwopt=(
      --unshare-pid --unshare-uts --unshare-ipc --unshare-cgroup
    
      --proc /proc --dev /dev --tmpfs /dev/shm --mqueue /dev/mqueue
    
      $(wdev /dev/dri /dev/v4l /dev/video*)
      $(r /sys/{dev,devices,bus/pci})
    
      --dir /var/tmp --dir /run/lock
      $(ln ../run /var/run) $(ln ../run/lock /var/lock)
      $(w /tmp/.{X11-unix,ICE-unix})
    
      $(r /usr/lib) $(ln usr/lib /lib64) $(ln lib /usr/lib64)
      $(r /usr/share)
      $(r /var/{cache/fontconfig,lib/dbus/machine-id})
    
      $(r /etc/{passwd,group,nsswitch.conf,resolv.conf,hosts,gai.conf,ld.so*})
      $(r /etc/{localtime,lsb-release,machine-id})
      $(r /etc/{ca-certificates,ssl})
      $(r /etc/{dconf,fonts,gtk-*,host.conf,xdg,mime.types,pulse})
     
      $(r ${XAUTHORITY} ${DBUS_SESSION_BUS_ADDRESS/unix:path=})
      $(w ${XDG_RUNTIME_DIR}/{ICEauthority,dconf,pulse,gvfsd,wayland-*,p11-kit,flatpak-info})
    
      $(w ~/.{mozilla,cache/mozilla})
      $(r ~/.cache/{fontconfig,mesa_shader_cache})
      $(r ~/.config/{dconf,fontconfig,user-dirs.dirs,gtk-*,mimeapps.list,pulse})
      $(r ~/.{fonts,local/share/{themes,icons}})
    
      $(w ~/down /tmp/swap)
    )
    
    exec nice \
      systemd-run --quiet --user --scope --slice=firefox.slice \
      bwrap --args 9 9< <(printf $'%s\0' $bwopt) \
      -- /usr/lib/firefox/firefox $@
    

    Using this for about 5 years. Ran strace on a session to see what to allow access to. It’s got full access to /lib and too much access to /sys b/c I’m lazy, but it can not see any executables or most of ~.

    I’m using something similar whenever I want to precisely isolate a program.

    • radicalpikachu@vlemmy.netOP
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      Thank you for this. But if I may ask can you tell me what some of these options do? I can understand what some of these do just by looking, like giving directory access.

      Will this work on my system where I use a combo of Wayland + Pipewire?

    • radicalpikachu@vlemmy.netOP
      link
      fedilink
      English
      arrow-up
      1
      ·
      edit-2
      1 year ago

      lmao shit.

      how did you find all these? Nevermind just fucking realized you are the one who commented all that lmao.

      PS. I actually solved most of my issues. ChatGPT is a wizard.