bwbox/lib/sandbox.nim

import os
import args
import json
import dbus
import utils
import bwrap
import config
import options

proc sandboxExec*(args: Args) =
  var call = BwrapCall()
  var configPath = none(string)

  let hostname = args.name.get(getProfile(args))

  if args.name.isSome:
    let name = args.name.unsafeGet
    let sandboxPath = getSandboxPath(name)
    let sandboxFiles = sandboxPath.joinPath("files")
    let userConfig = sandboxPath.joinPath("config.json")

    createDir(sandboxFiles)
    call.addArg("--bind", sandboxFiles, getHomeDir())

    if not fileExists(userConfig):
      let newConfig = %* {"extends": getProfile(args)}
      writeFile(userConfig, $newConfig)

    configPath = some(userConfig)

  if configPath.isNone or not fileExists(configPath.unsafeGet):
    configPath = some(getProfilePath(args))

  var config = loadConfig(configPath.unsafeGet)
  config.extendConfig()

  var proxy = DbusProxy()

  proxy
    .paths("/run/user/1000/bus", "/run/user/1000/.bus-sandboxed/test2")
    .addCall("org.freedesktop.Notifications.*=@/org/freedesktop/Notifications")
    .addCall("org.freedesktop.portal.*=*")
    .addBroadcast("org.freedesktop.portal.*=@/org/freedesktop/portal/*")
    .addOwn("org.mpris.MediaPlayer2.spotify")
    .filter()
    .log()
    .exec()

  call
    .addArg("--dev", "/dev")
    # https://github.com/flatpak/flatpak/blob/1bdbb80ac57df437e46fce2cdd63e4ff7704718b/common/flatpak-run.c#L1496
    .addMount("--dev-bind", "/dev/dri")
    .addMount("--dev-bind", "/dev/nvidiactl")
    .addMount("--dev-bind", "/dev/nvidia-modeset")
    .addMount("--dev-bind", "/dev/nvidia0")
    .addMount("--dev-bind", "/dev/random")
    .addMount("--dev-bind", "/dev/urandom")
    .addArg("--ro-bind", "/run/user/1000/.bus-sandboxed/test2", "/run/user/1000/bus")
    .addArg("--tmpfs", "/tmp")
    .addArg("--tmpfs", "/dev/shm")
    .addArg("--proc", "/proc")
    .addArg("--unshare-all")
    .addArg("--share-net")
    .addArg("--die-with-parent")
    .addArg("--setenv", "BWSANDBOX", "1")
    .applyConfig(config)

  if config.mountcwd.get(false):
    call
      .addMount("--bind", getCurrentDir())
      .addArg("--chdir", getCurrentDir())

  if config.sethostname.get(false):
    call
      .addArg("--hostname", hostname)

  call.addArg(args.getCmd).exec()