Update deps

.gitignore

@@ -1,2 +1,4 @@
 .idea
-main
+bwbox
+result
+scripts/applications

bwbox.nim

@@ -7,7 +7,7 @@ proc main(): int =
   let args = parseArgs()
 
   if args.isNone:
-    echo "Usage: bwshell --command=cmd --profile=profile <sandbox_name>"
+    echo "Usage: bwshell --name=sandbox_name --profile=profile <sandbox_cmd>"
     return 1
   else:
     randomize()

bwbox.nimble

@@ -0,0 +1,13 @@
+# Package
+
+version       = "1.0.0"
+author        = "mawalu"
+description   = "An experimental sandbox tool for linux apps"
+license       = "MIT"
+srcDir        = "."
+bin           = @["bwbox"]
+
+
+# Dependencies
+
+requires "nim >= 1.6.0"

configs/box

@@ -0,0 +1,4 @@
+{
+    "extends": "shell",
+    "mountcwd": true
+}

configs/default

@@ -1,6 +1,6 @@
 {
   "mount": [],
-  "romount": ["/etc", "/var", "/usr", "/opt", ".oh-my-zsh", ".zsh", ".zshrc"],
+  "romount": ["/etc", "/var", "/usr", "/opt"],
   "symlinks": [
     {"src": "usr/lib", "dst": "/lib"},
     {"src": "usr/lib64", "dst": "/lib64"},

configs/dev

@@ -0,0 +1,6 @@
+{
+    "extends": "shell",
+    "romount": [".gitconfig", ".gnupg", "/run/user/1000/gnupg", ".ssh/config"],
+    "mountcwd": true,
+    "mount": [".ssh/known_hosts"]
+}

configs/gui

@@ -0,0 +1,7 @@
+{
+    "extends": "default",
+    "romount": [".Xauthority", "/tmp/.X11-unix", "/run/user/1000/pulse/native"],
+    "dbus": true,
+    "dbuscall": ["org.freedesktop.Notifications.*=@/org/freedesktop/Notifications", "org.freedesktop.portal.*=*"],
+    "dbusbroadcast": ["org.freedesktop.portal.*=@/org/freedesktop/portal/*"]
+}

configs/shell

@@ -0,0 +1,5 @@
+{
+    "extends": "default",
+    "romount": [".oh-my-zsh", ".zsh", ".zshrc", ".zshrc-local"],
+    "sethostname": true
+}

configs/wayland

@@ -0,0 +1,7 @@
+{
+    "extends": "default",
+    "romount": ["/run/user/1000/pulse/native", "/run/user/1000/wayland-1"],
+    "dbus": true,
+    "dbuscall": ["org.freedesktop.Notifications.*=@/org/freedesktop/Notifications", "org.freedesktop.portal.*=*"],
+    "dbusbroadcast": ["org.freedesktop.portal.*=@/org/freedesktop/portal/*"]
+}

flake.lock

@@ -0,0 +1,26 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1720893482,
+        "narHash": "sha256-fGQczQ3JuvqSK3rYsJvvbE7j8BENLp8DqJH1B0uXYKg=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "94c843e8f05bac70e905c48c965ba7be79bde613",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,20 @@
+{
+  description = "An experimental sandboxing tool for linux apps";
+
+  inputs.nixpkgs.url = github:NixOS/nixpkgs;
+
+  outputs = { self, nixpkgs }: {
+    packages.x86_64-linux.default =
+      with import nixpkgs { system = "x86_64-linux"; };
+      buildNimPackage {
+        name = "bwbox";
+        src = self;
+        nativeBuildInputs = [pkgs.makeWrapper];
+        postInstall = ''
+          wrapProgram $out/bin/bwbox \
+            --prefix PATH ':' ${pkgs.bubblewrap}/bin \
+            --prefix PATH ':' ${pkgs.xdg-dbus-proxy}/bin
+        '';
+      };
+  };
+}

lib/args.nim

@@ -1,14 +1,14 @@
-import parseopt
 import options
 import os
 
 type Args* = object
   name*: Option[string]
-  cmd*: Option[string]
+  cmd*: Option[seq[string]]
   profile*: Option[string]
+  debug*: bool
 
-proc getCmd*(args: Args): string =
-  return args.cmd.get(getEnv("SHELL", "/bin/bash"))
+proc getCmd*(args: Args): seq[string] =
+  return args.cmd.get(@[getEnv("SHELL", "/bin/sh")])
 
 proc getProfile*(args: Args): string =
   if args.profile.isSome:
@@ -16,30 +16,34 @@ proc getProfile*(args: Args): string =
 
   return "default"
 
-proc parseOpt(args: var Args, key: string, value: string): bool =
-  case key
-  of "command", "c":
-    args.cmd = some(value)
-  of "profile", "p":
-    args.profile = some(value)
-  else:
-    return false
-
-  return true
-
 proc parseArgs*(): Option[Args] =
-  var p = initOptParser()
-  var args = Args()
+  var args = Args(debug: false)
 
-  while true:
-    p.next()
-    case p.kind
-    of cmdEnd: break
-    of cmdShortOption, cmdLongOption:
-      if p.val == "" or args.parseOpt(p.key, p.val) == false:
-        echo "Invalid argument ", p.val
-        return
-    of cmdArgument:
-      args.name = some(p.key.string)
+  var command = newSeq[string]()
+  var parsingSandboxArgs = true
+  var i = 1
 
+  while i <= paramCount():
+    var arg = paramStr(i)
+
+    if arg == "--name" and parsingSandboxArgs:
+      args.name = some(paramStr(i + 1))
+      i += 2
+    elif arg == "--profile" and parsingSandboxArgs:
+      args.profile = some(paramStr(i + 1))
+      i += 2
+    elif arg == "--debug" and parsingSandboxArgs:
+      args.debug = true
+      i += 1
+    else:
+      parsingSandboxArgs = false
+      command.add(arg)
+      i += 1
+
+  if command.len > 0:
+    args.cmd = some(command)
+
+  if args.name.isSome or args.cmd.isSome or args.profile.isSome:
     return some(args)
+  else:
+    return none(Args)

lib/bwrap.nim

@@ -1,8 +1,9 @@
+import os
 import posix
 import sequtils
 
 type BwrapCall* = object
-  args: seq[string]
+  args*: seq[string]
 
 proc addArg*(call: var BwrapCall, args: varargs[string]): var BwrapCall {.discardable.}  =
   for arg in args:
@@ -14,4 +15,4 @@ proc addMount*(call: var BwrapCall, mType: string, path: string): var BwrapCall
   call
 
 proc exec*(call: var BwrapCall) =
-  discard execv("/usr/bin/bwrap", allocCStringArray(@["bwrap"].concat(call.args)))
+  discard execv("/usr/bin/env", allocCStringArray(@["/usr/bin/env", "bwrap"].concat(call.args)))

lib/config.nim

@@ -3,6 +3,7 @@ import options
 import bwrap
 import utils
 import json
+import os
 
 type Link* = object
   src*: string
@@ -23,6 +24,7 @@ type Config* = object
   dbusown*: Option[seq[string]]
   dbuscall*: Option[seq[string]]
   dbusbroadcast*: Option[seq[string]]
+  devmount*: Option[seq[string]]
 
 proc applyConfig*(call: var BwrapCall, config: Config) =
   for mount in config.mount.get(@[]):
@@ -34,6 +36,14 @@ proc applyConfig*(call: var BwrapCall, config: Config) =
   for symlink in config.symlinks.get(@[]):
      call.addArg("--symlink", symlink.src, symlink.dst)
 
+  for device in config.devmount.get(@[]):
+      call.addArg("--dev-bind", device, device)
+
+  if config.mountcwd.get(false):
+      call
+        .addMount("--bind", getCurrentDir())
+        .addArg("--chdir", getCurrentDir())
+
 proc loadConfig*(path: string): Config =
   return readFile(path)
     .parseJson()
@@ -53,6 +63,7 @@ proc extendConfig*(config: var Config): Config {.discardable.} =
   config.mountcwd = some(config.mountcwd.get(eConf.mountcwd.get(false)))
   config.sethostname = some(config.sethostname.get(eConf.sethostname.get(false)))
   config.allowdri = some(config.allowdri.get(eConf.allowdri.get(false)))
+  config.devmount = some(config.devmount.get(eConf.devmount.get(@[])))
 
   config.dbus = some(config.dbus.get(eConf.dbus.get(false)))
   config.dbussee = some(config.dbussee.get(@[]).concat(eConf.dbussee.get(@[])))

lib/dbus.nim

@@ -10,10 +10,10 @@ type DbusProxy* = object
   socket*: string
   args: seq[string]
 
-proc exec*(proxy: var DbusProxy) =
+proc exec*(proxy: DbusProxy): Process =
   # todo: start dbus proxy in bwrap
   # todo: pass arguments as fd
-  proxy.process = startProcess("xdg-dbus-proxy", args = proxy.args,
+  startProcess("xdg-dbus-proxy", args = proxy.args,
     options = {poEchoCmd, poParentStreams, poUsePath})
 
 proc startDBusProxy*(config: Config, hostname: string): DbusProxy =
@@ -49,6 +49,6 @@ proc startDBusProxy*(config: Config, hostname: string): DbusProxy =
 
   proxy.args.add("--filter")
   proxy.args.add("--log")
-  proxy.exec()
+  proxy.process = proxy.exec()
 
   proxy

lib/sandbox.nim

@@ -1,4 +1,5 @@
 import strutils
+import sequtils
 import options
 import config
 import utils
@@ -36,9 +37,15 @@ proc sandboxExec*(args: Args) =
   config.extendConfig()
 
   call
+    .addArg("--new-session")
     .addArg("--dev", "/dev")
     .addMount("--dev-bind", "/dev/random")
     .addMount("--dev-bind", "/dev/urandom")
+    .addMount("--ro-bind", "/sys/block")
+    .addMount("--ro-bind", "/sys/bus")
+    .addMount("--ro-bind", "/sys/class")
+    .addMount("--ro-bind", "/sys/dev")
+    .addMount("--ro-bind", "/sys/devices")
     .addArg("--tmpfs", "/tmp")
     .addArg("--tmpfs", "/dev/shm")
     .addArg("--proc", "/proc")
@@ -48,6 +55,10 @@ proc sandboxExec*(args: Args) =
     .addArg("--setenv", "BWSANDBOX", "1")
     .applyConfig(config)
 
+  if config.sethostname.get(false):
+    call
+      .addArg("--hostname", hostname)
+
   if config.dbus.get(false):
     # todo: handle process and cleanup later
     let proxy = startDBusProxy(config, hostname)
@@ -60,13 +71,11 @@ proc sandboxExec*(args: Args) =
   if config.allowdri.get(false):
     enableDri(call)
 
-  if config.mountcwd.get(false):
-    call
-      .addMount("--bind", getCurrentDir())
-      .addArg("--chdir", getCurrentDir())
+  # resolve binary path outside of the sandbox
+  var cmd = args.getCmd
+  cmd[0] = findExe(cmd[0])
 
-  if config.sethostname.get(false):
-    call
-      .addArg("--hostname", hostname)
+  echo call.args.join("  ")
+  echo cmd
 
-  call.addArg(args.getCmd).exec()
+  call.addArg(cmd).exec()

lib/utils.nim

@@ -15,9 +15,19 @@ proc checkRelativePath*(p: string): string =
   getHomeDir().joinPath(p)
 
 proc getProfilePath*(profile: string): string =
-  getConfigDir()
-        .joinPath(APP_NAME)
-        .joinPath(profile)
+  let pid = getCurrentProcessId()
+
+  for path in [
+    getConfigDir().joinPath(APP_NAME),
+    &"/usr/share/{APP_NAME}",
+    parentDir(expandSymlink(&"/proc/{pid}/exe")).joinPath("configs")
+  ]:
+    let file = path.joinPath(profile)
+
+    if fileExists(file):
+      return file
+
+  raise newException(IOError, "Profile not found")
 
 proc getProfilePath*(args: Args): string =
   getProfilePath(args.getProfile())
@@ -31,17 +41,30 @@ proc deviceExists(path: string): bool =
   var res: Stat
   return stat(path, res) >= 0 and S_ISCHR(res.st_mode)
 
+proc mountDriFolder(call: var BwrapCall, path: string) =
+  for file in walkPattern(&"{path}/*"):
+    if dirExists(file):
+      mountDriFolder(call, file)
+    elif deviceExists(file):
+      call.addMount("--dev-bind", file)
+    #else:
+    #  call.addMount("--ro-bin", file)
+
 # https://github.com/flatpak/flatpak/blob/1bdbb80ac57df437e46fce2cdd63e4ff7704718b/common/flatpak-run.c#L1496
 proc enableDri*(call: var BwrapCall) =
+  const folder = "/dev/dri"
   const mounts = [
-    "/dev/dri",                                # general
+    folder,                                    # general
     "/dev/mali", "/dev/mali0", "/dev/umplock", # mali
     "/dev/nvidiactl", "/dev/nvidia-modeset",   # nvidia
     "/dev/nvidia-uvm", "/dev/nvidia-uvm-tools" # nvidia OpenCl/CUDA
   ]
 
+  if dirExists(folder):
+    mountDriFolder(call, folder)
+
   for mount in mounts:
-    if deviceExists(mount):
+    if deviceExists(mount) or dirExists(mount):
       call.addMount("--dev-bind", mount)
 
   for i in 0..20:

scripts/applications.sh

@@ -0,0 +1,29 @@
+#!/run/current-system/sw/bin/bash
+
+if [ $# -ne 1 ]; then
+  echo "Usage: $0 <target_dir>"
+  exit 1
+fi
+
+check_dir() {
+  local dir=$1
+  local file
+
+  for application in "$dir/"*; do
+    file="$(basename "$application")"
+
+    sed "s/^Exec=/Exec=bwbox --name '$file' --profile wayland /gi" "$application" > "$target/$file"
+  done
+}
+
+dirs=($(echo "$XDG_DATA_DIRS" | tr ':' '\n'))
+dirs+=("$HOME/.local/share")
+target="$1"
+
+mkdir -p "$target"
+
+for dir in "${dirs[@]}"; do
+  if [ -d "$dir/applications" ]; then
+    check_dir "$dir/applications"
+  fi
+done