this post was submitted on 20 Jun 2023
2 points (100.0% liked)
Arch Linux
7609 readers
29 users here now
The beloved lightweight distro
founded 4 years ago
MODERATORS
lmao shit.
how did you find all these? Nevermind just fucking realized you are the one who commented all that lmao.
PS. I actually solved most of my issues. ChatGPT is a wizard.
Here's how I run Firefox, for instance:
#!/bin/zsh
function r { for p in $@; do [[ -e $p ]] && echo --ro-bind-try $p $p; done; }
function w { for p in $@; do [[ -e $p ]] && echo --bind-try $p $p; done; }
function ln { echo --symlink $1 $2; }
function wdev { for p in $@; do echo --dev-bind-try $p $p; done; }
bwopt=(
--unshare-pid --unshare-uts --unshare-ipc --unshare-cgroup
--proc /proc --dev /dev --tmpfs /dev/shm --mqueue /dev/mqueue
$(wdev /dev/dri /dev/v4l /dev/video*)
$(r /sys/{dev,devices,bus/pci})
--dir /var/tmp --dir /run/lock
$(ln ../run /var/run) $(ln ../run/lock /var/lock)
$(w /tmp/.{X11-unix,ICE-unix})
$(r /usr/lib) $(ln usr/lib /lib64) $(ln lib /usr/lib64)
$(r /usr/share)
$(r /var/{cache/fontconfig,lib/dbus/machine-id})
$(r /etc/{passwd,group,nsswitch.conf,resolv.conf,hosts,gai.conf,ld.so*})
$(r /etc/{localtime,lsb-release,machine-id})
$(r /etc/{ca-certificates,ssl})
$(r /etc/{dconf,fonts,gtk-*,host.conf,xdg,mime.types,pulse})
$(r ${XAUTHORITY} ${DBUS_SESSION_BUS_ADDRESS/unix:path=})
$(w ${XDG_RUNTIME_DIR}/{ICEauthority,dconf,pulse,gvfsd,wayland-*,p11-kit,flatpak-info})
$(w ~/.{mozilla,cache/mozilla})
$(r ~/.cache/{fontconfig,mesa_shader_cache})
$(r ~/.config/{dconf,fontconfig,user-dirs.dirs,gtk-*,mimeapps.list,pulse})
$(r ~/.{fonts,local/share/{themes,icons}})
$(w ~/down /tmp/swap)
)
exec nice \
systemd-run --quiet --user --scope --slice=firefox.slice \
bwrap --args 9 9< <(printf $'%s\0' $bwopt) \
-- /usr/lib/firefox/firefox $@
Using this for about 5 years. Ran strace
on a session to see what to allow access to. It's got full access to /lib
and too much access to /sys
b/c I'm lazy, but it can not see any executables or most of ~
.
I'm using something similar whenever I want to precisely isolate a program.
How do I use this btw? I pasted this on an executable and it says Permission Denied
.
view more: next ›