78 lines
2.2 KiB
Nim
78 lines
2.2 KiB
Nim
import os
|
|
import args
|
|
import json
|
|
import dbus
|
|
import utils
|
|
import bwrap
|
|
import config
|
|
import options
|
|
|
|
proc sandboxExec*(args: Args) =
|
|
var call = BwrapCall()
|
|
var configPath = none(string)
|
|
|
|
let hostname = args.name.get(getProfile(args))
|
|
|
|
if args.name.isSome:
|
|
let name = args.name.unsafeGet
|
|
let sandboxPath = getSandboxPath(name)
|
|
let sandboxFiles = sandboxPath.joinPath("files")
|
|
let userConfig = sandboxPath.joinPath("config.json")
|
|
|
|
createDir(sandboxFiles)
|
|
call.addArg("--bind", sandboxFiles, getHomeDir())
|
|
|
|
if not fileExists(userConfig):
|
|
let newConfig = %* {"extends": getProfile(args)}
|
|
writeFile(userConfig, $newConfig)
|
|
|
|
configPath = some(userConfig)
|
|
|
|
if configPath.isNone or not fileExists(configPath.unsafeGet):
|
|
configPath = some(getProfilePath(args))
|
|
|
|
var config = loadConfig(configPath.unsafeGet)
|
|
config.extendConfig()
|
|
|
|
var proxy = DbusProxy()
|
|
|
|
proxy
|
|
.paths("/run/user/1000/bus", "/run/user/1000/.bus-sandboxed/test2")
|
|
.addCall("org.freedesktop.Notifications.*=@/org/freedesktop/Notifications")
|
|
.addCall("org.freedesktop.portal.*=*")
|
|
.addBroadcast("org.freedesktop.portal.*=@/org/freedesktop/portal/*")
|
|
.addOwn("org.mpris.MediaPlayer2.spotify")
|
|
.filter()
|
|
.log()
|
|
.exec()
|
|
|
|
call
|
|
.addArg("--dev", "/dev")
|
|
# https://github.com/flatpak/flatpak/blob/1bdbb80ac57df437e46fce2cdd63e4ff7704718b/common/flatpak-run.c#L1496
|
|
.addMount("--dev-bind", "/dev/dri")
|
|
.addMount("--dev-bind", "/dev/nvidiactl")
|
|
.addMount("--dev-bind", "/dev/nvidia-modeset")
|
|
.addMount("--dev-bind", "/dev/nvidia0")
|
|
.addMount("--dev-bind", "/dev/random")
|
|
.addMount("--dev-bind", "/dev/urandom")
|
|
.addArg("--ro-bind", "/run/user/1000/.bus-sandboxed/test2", "/run/user/1000/bus")
|
|
.addArg("--tmpfs", "/tmp")
|
|
.addArg("--tmpfs", "/dev/shm")
|
|
.addArg("--proc", "/proc")
|
|
.addArg("--unshare-all")
|
|
.addArg("--share-net")
|
|
.addArg("--die-with-parent")
|
|
.addArg("--setenv", "BWSANDBOX", "1")
|
|
.applyConfig(config)
|
|
|
|
if config.mountcwd.get(false):
|
|
call
|
|
.addMount("--bind", getCurrentDir())
|
|
.addArg("--chdir", getCurrentDir())
|
|
|
|
if config.sethostname.get(false):
|
|
call
|
|
.addArg("--hostname", hostname)
|
|
|
|
call.addArg(args.getCmd).exec()
|