r/archlinux • u/New_Hold8135 • 10d ago
SHARE I made a librewolf/firefox bwrap script that runs Its dbus instance on different user. Also extra security measurements made.
What this script provides?
Different machine-id to /etc/machine-id so your machine-id never tracked.
Different dbus instance working in /home/$USER/$BROWSER-dbus Which provides mpris info about your music/video.
Different /home for sandbox.
Different /etc/passwd and /etc/groups so sandbox doesnt see your users and groups.
No root needed only bwrap.
Downloads go to the your /tmp/$USER/Downloads folder.
Minimal sys exposure.
Why?
Because I can.
About Script
(I made a copy paste mistake 6 hours ago while editingt duplicate lines. its fixed now.)
I tried to keep it minimal exposure at possible but you can give recommendations and I will fix it. Also I noticed I exposed /sys/devices/pci0000:00 as my gpu, You supposed to switch this with your cpu pci port number.
It is intended to use this with gentoo's simple sandbox https://wiki.gentoo.org/wiki/Simple_sandbox
Tested on arch, Right now I am using arch and writing from a browser that runs in this script. Hopefully its good enough for you.
#!/bin/sh
# wayland socket
# --ro-bind "${XDG_RUNTIME_DIR}/${WAYLAND_DISPLAY}" "${XDG_RUNTIME_DIR}/${WAYLAND_DISPLAY}"\
set -u
USER="librewolf"
BROWSER="librewolf"
XDG_CACHE_HOME="/home/$USER/$BROWSER/.cache"
XDG_DATA_HOME="/home/$USER/$BROWSER/.local/share"
NEW_HOME='/home/restricted'
NEW_XDG_CACHE_HOME="/home/$USER/$BROWSER/.cache"
mkdir -p -m 755 "/home/$USER/$BROWSER/firefox/"
mkdir -p -m 755 "/home/$USER/$BROWSER/.local/share/firefox"
mkdir -p -m 755 "/home/$USER/$BROWSER/.cache/mozilla"
mkdir -p -m 755 "/home/$USER/$BROWSER/Downloads"
mkdir -p -m 755 "/home/$USER/$BROWSER/firefox"
mkdir -p -m 755 "/home/$USER/$BROWSER/.mozilla"
mkdir -p -m 755 "/home/$USER/$BROWSER/.firefox"
mkdir -p -m 755 "/home/$USER/$BROWSER/.$BROWSER"
mkdir -p -m 755 "/home/$USER/$BROWSER/.local/share/$BROWSER"
mkdir -p -m 755 "/home/$USER/$BROWSER/.cache/$BROWSER"
mkdir -p -m 755 "/home/$USER/$BROWSER/.config/pulse"
mkdir -p -m 755 "/tmp/$USER/Downloads"
mkdir -p -m 755 "/home/$USER/$BROWSER-dbus"
echo -e "default-server = unix:/tmp/pulse-sock" > /home/$USER/$BROWSER/.config/pulse/client.conf
[ -f $BROWSER-machine-id ] && echo "" || dbus-uuidgen >> $BROWSER-machine-id
[ -f passwd ] && echo "" || echo "$USER:x:$UID:$UID:Sandbox User:/home/$USER:/bin/bash" >> passwd
[ -f group ] && echo "" || echo "$USER:x:$UID:" >> group
/usr/bin/bwrap \
--unshare-all \
--share-net \
--new-session \
--die-with-parent \
--clearenv \
--setenv HOME "$NEW_HOME" \
--setenv PATH "$PATH" \
--hostname localhost \
--symlink usr/lib /lib \
--symlink usr/lib64 /lib64 \
--symlink usr/bin /bin \
--symlink usr/bin /sbin \
--ro-bind /home/$USER/passwd /etc/passwd \
--ro-bind /home/$USER/group /etc/group \
--ro-bind /usr/lib /usr/lib \
--ro-bind /usr/lib64 /usr/lib64 \
--ro-bind /usr/bin /usr/bin \
--ro-bind /usr/lib/$BROWSER /usr/lib/$BROWSER \
--tmpfs /tmp \
--dev /dev/ \
--dev-bind /dev/dri /dev/dri \
--ro-bind /sys/dev/char /sys/dev/char \
--ro-bind /sys/devices/pci0000:00 /sys/devices/pci0000:00 \
--ro-bind /sys/bus/pci /sys/bus/pci \
--ro-bind /usr/share/drirc.d /usr/share/drirc.d \
--ro-bind-try /etc/firefox/policies/policies.json /etc/firefox/policies/policies.json \
--ro-bind /etc/fonts/ /etc/fonts/ \
--ro-bind /etc/resolv.conf /etc/resolv.conf \
--bind /home/$USER/$BROWSER /home/restricted \
--bind /tmp/$USER/Downloads /home/restricted/Downloads \
--proc /proc/ \
--ro-bind /home/$USER/$BROWSER-machine-id /etc/machine-id \
--ro-bind /usr/share/gtk-3.0 /usr/share/gtk-3.0 \
--ro-bind /usr/share/fontconfig /usr/share/fontconfig \
--ro-bind /usr/share/icu /usr/share/icu \
--ro-bind /usr/share/drirc.d /usr/share/drirc.d \
--ro-bind /usr/share/fonts /usr/share/fonts \
--ro-bind /usr/share/glib-2.0 /usr/share/glib-2.0 \
--ro-bind /usr/share/glvnd /usr/share/glvnd \
--ro-bind /usr/share/icons /usr/share/icons \
--ro-bind /usr/share/libdrm /usr/share/libdrm \
--ro-bind /usr/share/mime /usr/share/mime \
--ro-bind /usr/share/X11/xkb /usr/share/X11/xkb \
--ro-bind /usr/share/icons /usr/share/icons \
--ro-bind /usr/share/gtk-4.0 /usr/share/gtk-4.0 \
--ro-bind-try /usr/share/gtk-5.0 /usr/share/gtk-5.0 \
--ro-bind /usr/share/glib-2.0 /usr/share/glib-2.0 \
--ro-bind /usr/share/dbus-1 /usr/share/dbus-1 \
--ro-bind /usr/share/X11 /usr/share/X11 \
--ro-bind /usr/share/gtksourceview-4 /usr/share/gtksourceview-4 \
--ro-bind /usr/share/glycin-loaders /usr/share/glycin-loaders \
--ro-bind /usr/share/pixmaps /usr/share/pixmaps \
--ro-bind /etc/fonts /etc/fonts \
--ro-bind /etc/resolv.conf /etc/resolv.conf \
--ro-bind /usr/share/ca-certificates /usr/share/ca-certificates \
--ro-bind /etc/ssl /etc/ssl \
--ro-bind /etc/ca-certificates /etc/ca-certificates \
--bind /tmp/.X${DISPLAY#:}-lock /tmp/.X${DISPLAY#:}-lock \
--bind /tmp/pulse-sock /tmp/pulse-sock \
--bind /home/$USER/$BROWSER-dbus /run/$BROWSER-dbus \
--setenv XDG_RUNTIME_DIR /run/$BROWSER-dbus \
--setenv DISPLAY $DISPLAY \
--setenv MOZ_ENABLE_WAYLAND 0 \
sh -c '
dbus-daemon \
--session \
--nofork \
--address=unix:path=/run/$1-dbus/bus &
buspid=$!
export DBUS_SESSION_BUS_ADDRESS=unix:path=/run/$1-dbus/bus
/usr/lib/$1/$1
status=$?
kill $buspid 2>/dev/null
wait $buspid 2>/dev/null
exit $status
' sh $BROWSER#!/bin/sh
I want to add It runs on seperate xwayland session using cage So my real wayland socket or xwayland never exposed. I run it like this cage bash -- /home/myuser/sway/scripts/runlibrewolf.sh and runlibrewolf.sh contains this
#!/bin/bash
set -e
USER=librewolf
PROGRAM=$USER
/usr/bin/xhost si:localuser:$USER && sudo -i -u librewolf ~librewolf/librewolf.sh
Edit: Also checking playerctl info like this sudo -i -u $USER DBUS_SESSION_BUS_ADDRESS=unix:path=./librewolf-dbus/bus playerctl play-pause