... |
... |
@@ -30,6 +30,75 @@ invoked_name="$(basename "${0}")"
|
30 |
30 |
# By default, invoke "firefox":
|
31 |
31 |
browser_path='firefox'
|
32 |
32 |
|
|
33 |
+# Base directory for our crap
|
|
34 |
+work_dir_base="/run/user/$(id -u)/browser-wrapper"
|
|
35 |
+mk_dir "${work_dir_base}" 0700
|
|
36 |
+work_dir="$(mktemp --directory "${work_dir_base}/$$.XXXXXXXX")" || \
|
|
37 |
+ exit_with_message 110 "Unable to create working directory, aborting."
|
|
38 |
+
|
|
39 |
+# Directory to replace /home
|
|
40 |
+slash_home_dir="${work_dir}/slash_home"
|
|
41 |
+# Directory to replace $HOME
|
|
42 |
+home_dir="${work_dir}/home"
|
|
43 |
+# Directory to replace /tmp
|
|
44 |
+tmp_dir="${work_dir}/tmp"
|
|
45 |
+# Empty dir to replace /dev
|
|
46 |
+dev_dir="${work_dir}/dev"
|
|
47 |
+# Directory for uploads
|
|
48 |
+upload_dir="${HOME}/Uploads"
|
|
49 |
+# Directory for downloads
|
|
50 |
+download_dir="${HOME}/Downloads"
|
|
51 |
+
|
|
52 |
+for directory in {{slash_,}home,tmp,{up,down}load,dev}_dir; do
|
|
53 |
+ mk_dir "${!directory}" 0700
|
|
54 |
+done
|
|
55 |
+
|
|
56 |
+# Leverage proot to make the browser believe that:
|
|
57 |
+# - /home is either empty or contains only our home
|
|
58 |
+slash_home_options="--bind=${slash_home_dir}:/home"
|
|
59 |
+# - the home directory is almost empty
|
|
60 |
+home_options="--bind=${home_dir}:${HOME}"
|
|
61 |
+# - its configuration directory is still there
|
|
62 |
+# - its cache directory is still there
|
|
63 |
+browser_conf_options="
|
|
64 |
+ --bind=${HOME}/.mozilla/firefox:${HOME}/.mozilla/firefox \
|
|
65 |
+ --bind=${HOME}/.cache/mozilla/firefox:${HOME}/.cache/mozilla/firefox"
|
|
66 |
+# - its download directory is still there
|
|
67 |
+# (at least the one for English speakers)
|
|
68 |
+download_options="--bind=${download_dir}:${HOME}/Downloads"
|
|
69 |
+# - a ~/Uploads directory is present
|
|
70 |
+upload_options="--bind=${upload_dir}:${HOME}/Uploads"
|
|
71 |
+# - ~/.adobe and ~/.macromedia are still there
|
|
72 |
+# (for the sake of Flash Player and other plugins)
|
|
73 |
+adobe_options="
|
|
74 |
+ --bind=${HOME}/.adobe:${HOME}/.adobe \
|
|
75 |
+ --bind=${HOME}/.macromedia:${HOME}/.macromedia"
|
|
76 |
+# - various directories related to Java applets are still there
|
|
77 |
+# (assuming IcedTea-Web >= 1.5 / OpenJDK)
|
|
78 |
+java_options="
|
|
79 |
+ --bind=${HOME}/.config/icedtea-web:${HOME}/.config/icedtea-web
|
|
80 |
+ --bind=${HOME}/.cache/icedtea-web:${HOME}/.cache/icedtea-web
|
|
81 |
+ --bind=${HOME}/.java:${HOME}/.java
|
|
82 |
+ --bind=${HOME}/.local/share/applications/javaws:${HOME}/.local/share/application/javaws"
|
|
83 |
+# - /tmp is empty
|
|
84 |
+# (as in: do not even try to mess with the Unix sockets to ssh-agent)
|
|
85 |
+tmp_options="--bind=${tmp_dir}:/tmp"
|
|
86 |
+# - /sys is simply absent
|
|
87 |
+# (Firefox tries to reach various things under /sys/devices/system/ but
|
|
88 |
+# seems to cope without it)
|
|
89 |
+sys_options="--bind=/dev/null:/sys"
|
|
90 |
+# - /proc is still there, unless you want to hit that very detailed error:
|
|
91 |
+# too much recursion
|
|
92 |
+# - /proc/sys is still there, unless you want to hit that charming error:
|
|
93 |
+# FATAL: error reading `/proc/sys/crypto/fips_enabled' in libgcrypt: Not a directory
|
|
94 |
+proc_options=""
|
|
95 |
+# - /dev is present yet minimalist
|
|
96 |
+dev_options="
|
|
97 |
+ --bind=${dev_dir}:/dev
|
|
98 |
+ --bind=/dev/null:/dev/null
|
|
99 |
+ --bind=/dev/random:/dev/random
|
|
100 |
+ --bind=/dev/urandom:/dev/urandom"
|
|
101 |
+
|
33 |
102 |
# Let users override this through "configuration files":
|
34 |
103 |
generic_config_path="${HOME}/.config/browser-wrapper/main.conf"
|
35 |
104 |
[ -f "${generic_config_path}" ] && source "${generic_config_path}"
|
... |
... |
@@ -42,29 +111,6 @@ specific_config_path="${HOME}/.config/browser-wrapper/${invoked_name}.conf"
|
42 |
111 |
if [ -x "$(which proot)" ]; then
|
43 |
112 |
echo "proot is present and will be used to mask some directories"
|
44 |
113 |
|
45 |
|
- # Base directory for our crap
|
46 |
|
- work_dir_base="/run/user/$(id -u)/browser-wrapper"
|
47 |
|
- mk_dir "${work_dir_base}" 0700
|
48 |
|
- work_dir="$(mktemp --directory "${work_dir_base}/$$.XXXXXXXX")" || \
|
49 |
|
- exit_with_message 110 "Unable to create working directory, aborting."
|
50 |
|
-
|
51 |
|
- # Directory to replace /home
|
52 |
|
- slash_home_dir="${work_dir}/slash_home"
|
53 |
|
- # Directory to replace $HOME
|
54 |
|
- home_dir="${work_dir}/home"
|
55 |
|
- # Directory to replace /tmp
|
56 |
|
- tmp_dir="${work_dir}/tmp"
|
57 |
|
- # Empty dir to replace /dev
|
58 |
|
- dev_dir="${work_dir}/dev"
|
59 |
|
- # Directory for uploads
|
60 |
|
- upload_dir="${HOME}/Uploads"
|
61 |
|
- # Directory for downloads
|
62 |
|
- download_dir="${HOME}/Downloads"
|
63 |
|
-
|
64 |
|
- for directory in {{slash_,}home,tmp,{up,down}load,dev}_dir; do
|
65 |
|
- mk_dir "${!directory}" 0700
|
66 |
|
- done
|
67 |
|
-
|
68 |
114 |
echo 'Tips:'
|
69 |
115 |
echo " Your fake home is ${home_dir}"
|
70 |
116 |
echo " Your fake /tmp is ${tmp_dir}"
|
... |
... |
@@ -73,51 +119,6 @@ if [ -x "$(which proot)" ]; then
|
73 |
119 |
echo ' Do you need to download files?'
|
74 |
120 |
echo " They should end up in ${download_dir}"
|
75 |
121 |
|
76 |
|
- # Leverage proot to make the browser believe that:
|
77 |
|
- # - /home is either empty or contains only our home
|
78 |
|
- slash_home_options="--bind=${slash_home_dir}:/home"
|
79 |
|
- # - the home directory is almost empty
|
80 |
|
- home_options="--bind=${home_dir}:${HOME}"
|
81 |
|
- # - its configuration directory is still there
|
82 |
|
- # - its cache directory is still there
|
83 |
|
- browser_conf_options="
|
84 |
|
- --bind=${HOME}/.mozilla/firefox:${HOME}/.mozilla/firefox \
|
85 |
|
- --bind=${HOME}/.cache/mozilla/firefox:${HOME}/.cache/mozilla/firefox"
|
86 |
|
- # - its download directory is still there
|
87 |
|
- # (at least the one for English speakers)
|
88 |
|
- download_options="--bind=${download_dir}:${HOME}/Downloads"
|
89 |
|
- # - a ~/Uploads directory is present
|
90 |
|
- upload_options="--bind=${upload_dir}:${HOME}/Uploads"
|
91 |
|
- # - ~/.adobe and ~/.macromedia are still there
|
92 |
|
- # (for the sake of Flash Player and other plugins)
|
93 |
|
- adobe_options="
|
94 |
|
- --bind=${HOME}/.adobe:${HOME}/.adobe \
|
95 |
|
- --bind=${HOME}/.macromedia:${HOME}/.macromedia"
|
96 |
|
- # - various directories related to Java applets are still there
|
97 |
|
- # (assuming IcedTea-Web >= 1.5 / OpenJDK)
|
98 |
|
- java_options="
|
99 |
|
- --bind=${HOME}/.config/icedtea-web:${HOME}/.config/icedtea-web
|
100 |
|
- --bind=${HOME}/.cache/icedtea-web:${HOME}/.cache/icedtea-web
|
101 |
|
- --bind=${HOME}/.java:${HOME}/.java
|
102 |
|
- --bind=${HOME}/.local/share/applications/javaws:${HOME}/.local/share/application/javaws"
|
103 |
|
- # - /tmp is empty
|
104 |
|
- # (as in: do not even try to mess with the Unix sockets to ssh-agent)
|
105 |
|
- tmp_options="--bind=${tmp_dir}:/tmp"
|
106 |
|
- # - /sys is simply absent
|
107 |
|
- # (Firefox tries to reach various things under /sys/devices/system/ but
|
108 |
|
- # seems to cope without it)
|
109 |
|
- sys_options="--bind=/dev/null:/sys"
|
110 |
|
- # - /proc is still there, unless you want to hit that very detailed error:
|
111 |
|
- # too much recursion
|
112 |
|
- # - /proc/sys is still there, unless you want to hit that charming error:
|
113 |
|
- # FATAL: error reading `/proc/sys/crypto/fips_enabled' in libgcrypt: Not a directory
|
114 |
|
- proc_options=""
|
115 |
|
- # - /dev is present yet minimalist
|
116 |
|
- dev_options="
|
117 |
|
- --bind=${dev_dir}:/dev
|
118 |
|
- --bind=/dev/null:/dev/null
|
119 |
|
- --bind=/dev/random:/dev/random
|
120 |
|
- --bind=/dev/urandom:/dev/urandom"
|
121 |
122 |
proot \
|
122 |
123 |
${pre_options} \
|
123 |
124 |
${slash_home_options} \
|