sunaba.sh

#!/usr/bin/env bash

# SC2236 (style): Use -n instead of ! -z. (https://www.shellcheck.net/wiki/SC2236)
# shellcheck disable=SC2236

# list of arguments that will be passed to bwrap
argv=()
function arg(){ argv+=("--$1" "${@:2}"); }
function _pass() {
	for p in "${@:2}"; do
		arg "$1" "$p" "$p"
	done
}
function pass() { _pass bind "$@"; }
function ro-pass() { _pass ro-bind "$@"; }
function dev-pass() { _pass dev-bind "$@"; }

function try-pass() { _pass bind-try "$@"; }
function try-ro-pass() { _pass ro-bind-try "$@"; }
function try-dev-pass() { _pass dev-bind-try "$@"; }

# enables networking capability
# usage: enable_net
function enable_net() {
	ro-pass '/etc/resolv.conf'
	arg share-net
}

# enables pipewire/pulse related files for audio
# usage: enable_audio
function enable_audio() {
	if [ -S "$XDG_RUNTIME_DIR/pipewire-0" ]; then
        ro-pass "$XDG_RUNTIME_DIR/pipewire-0"
    fi
    if [ -d "$XDG_RUNTIME_DIR/pulse" ]; then
        ro-pass "$XDG_RUNTIME_DIR/pulse"
    fi
}

# usage: enable_wayland
function enable_wayland () {
	if [ ! -z "$WAYLAND_DISPLAY" ] && [ -S "$XDG_RUNTIME_DIR/$WAYLAND_DISPLAY" ]; then
  	ro-pass "$XDG_RUNTIME_DIR/$WAYLAND_DISPLAY"
  	ro-pass "$XDG_RUNTIME_DIR/$WAYLAND_DISPLAY.lock"

		arg setenv 'WAYLAND_DISPLAY' "$WAYLAND_DISPLAY"
	else
		echo "warning: WAYLAND_DISPLAY is not set, or its socket is not found, wayland is not passed"
	fi
}

# usage: enable_x11
function enable_x11 () {
	if [ ! -z "$DISPLAY" ]; then
		# arg bind "/tmp/.X11-unix/X${DISPLAY#:*}" "/tmp/.X11-unix/X${DISPLAY#:*}"
		DISPLAY_ID="$(grep -Pom1 '[0-9]+' <<< "$DISPLAY" | head -n 1)"
		pass "/tmp/.X11-unix/X${DISPLAY_ID#:*}"

		arg setenv 'DISPLAY' :"$DISPLAY_ID"

		ro-pass "$XAUTHORITY"
		arg setenv 'XAUTHORITY' "$XAUTHORITY"
	else
		echo "warning: DISPLAY is not set, X11 is not passed"
	fi
}

# enables display support (should be both X11 and Wayland)
# usage: enable_display
function enable_display() {
	enable_wayland
	enable_x11
}

# enables dbus suppoprt
# usage: enable_dbus
function enable_dbus() {
	ro-pass "$(sed 's/^unix:path=//g' <<< "$DBUS_SESSION_BUS_ADDRESS" | sed 's/,guid=[0-9a-f]*$//g')" # "$XDG_RUNTIME_DIR/bus"
	arg setenv 'DBUS_SESSION_BUS_ADDRESS' "$DBUS_SESSION_BUS_ADDRESS"
}

# passes DRI devices
# usage: pass_dri
function pass_dri() {
	ro-pass '/sys/devices'
	dev-pass '/dev/dri'
}

# passes DRM devices
# usage: pass_drm
function pass_drm() {
	ro-pass '/sys/class/drm'
}

# passes NVIDIA related items
# usage: pass_nvidia
function pass_nvidia() {
	for i in '/dev/nvidia'* '/sys/module/nvidia'*; do
		try-dev-pass "$i"
	done
}

# common passthrough
# usage: common_env <host_homedir_replacement>
function common_env(){
	# if no homedir is set, fail
	if [ -z "$1" ]; then
		echo 'common_passthrough requires an argument of the home dir to sandbox' >&2
		return 1
	fi

	# ensure that path is existant and can work
	if ! mkdir -p "$1"; then
		echo 'failed to create the sandbox homedir' >&2
		return 1
	fi

	# clear slate
	arg clearenv

	# setup the default "fs"
	arg dev '/dev'
	arg proc '/proc'
	arg tmpfs '/tmp'
	arg symlink '/usr/lib' '/lib'
	arg symlink '/usr/lib' '/lib64'
	arg symlink '/usr/bin' '/bin'
	arg symlink '/usr/bin' '/sbin'
	arg symlink '/run' '/var/run'
	ro-pass '/usr'

	# passing through /etc files
	ro-pass '/etc/fonts' '/etc/localtime'
	arg file 200 /etc/passwd
	arg file 201 /etc/group

	# these file may or may not exist, so only try but don't fail
	try-ro-pass \
		'/etc/profile' '/etc/profile.d' '/etc/bash.bashrc' \
		'/etc/ld.so.cache' '/etc/ld.so.conf' '/etc/ld.so.conf.d'

	# set uid/gid to the current user's id
	arg uid "$(id -u)"
	arg gid "$(id -g)"

	# basic devices
	ro-pass '/sys/dev/char'
	arg bind "$1" "/home/$USER"

	# pass-through certificates
	ro-pass '/usr/share/ca-certificates'
	ro-pass '/etc/ssl'
	ro-pass '/etc/ca-certificates'

	# default home env + path (not exported due to profile.d not being loaded by default)
	arg setenv 'USER' "$USER"
	arg setenv 'HOME' "/home/$USER"
	arg setenv 'XDG_CACHE_HOME' "/home/$USER/.cache"
	arg setenv 'XDG_CONFIG_HOME' "/home/$USER/.config"
	arg setenv 'XDG_RUNTIME_DIR' "$XDG_RUNTIME_DIR"
	arg setenv 'PATH' '/usr/local/sbin:/usr/local/bin:/usr/bin'

	arg setenv LANG 'en_US.UTF-8'
	arg setenv LANGUAGE 'en_US.UTS-8'
	arg setenv LC_ALL 'C'

	# unshare everything
	arg unshare-all

	# pass appropriate terminal
	if [ ! -z "$TERM" ]; then
		arg setenv 'TERM' "$TERM"
	fi

	# ensure everything dies with parent
	arg die-with-parent
}

# pass input devices
# usage: pass_input_devices
function pass_input_devices(){
	dev-pass "/dev/input"
}

# executes the bwrap with given arguments
# usage: execute <command> [...arguments]
function execute() {
	bwrap "${argv[@]}" -- "$@" \
	  200< <(getent passwd "$(id -u)" 65534) \
		201< <(getent group "$(id -u)" 65534)
}

#
#  sunaba.sh is used as a script
#
if [ "${BASH_SOURCE[0]}" = "${0}" ]; then
	function print_help(){
		echo "usage: $0 [flags] -- <bwrap args> -- <command> [arguments]"
		echo "       $0 [flags] -- <command> [arguments]"
		echo ""
		echo "this script implicitly calls 'common_env' with '\$SANDBOX_DIR' which will be set to '\$HOME/.sandbox' by default"
		echo "the flags can be the following:"
		echo "    -d    enables X11/Wayland support (equivalent to -wx)"
		echo "    -w    enables Wayland support only"
		echo "    -x    enables X11 support only"
		echo "    -a    enabled PipeWire/pulseaudio support"
		echo "    -n    enables networking capabilities"
		echo "    -s    passes dbus session socket"
		echo "    -r    passes all dri devices"
		echo "    -i    passes all input devices"
		echo "    -v    verbose (just dumps the argv before execution)"
		echo "    -h    displays this help and exits"
		echo "    -N    passes nvidia devices"
		echo "    -D    passes DRM devices"
		echo ""
		echo "for convenience, these options were added to bwrap args:"
		echo "   --pass <path>        equivalent to '--bind <path> <path>'"
		echo "   --ro-pass <path>     the same as above, however with '--ro-bind'"
		echo "   --pass-try <path>    same as pass, but instead of --bind, it's --bind-try"
		echo "   --ro-pass-try <path> same as above, however with '--ro-bind-try'"
		exit 1
	}

	# if $SANDBOX_DIR is not specified, use the default in $HOME/.sandbox
	if [ -z "$SANDBOX_DIR" ]; then
		SANDBOX_DIR="$HOME/.sandbox"
	fi
	common_env "$SANDBOX_DIR"

	# VERBOSE just dumps the final arguments passed to bwrap
	VERBOSE=0

	# parse the flags (default)
	while getopts 'dwxansrihvND' option; do
		case "$option" in
			d) enable_display ;;
			w) enable_wayland ;;
			x) enable_x11 ;;
			a) enable_audio ;;
			n) enable_net ;;
			s) enable_dbus ;;
			r) pass_dri ;;
			i) pass_input_devices ;;
			h) print_help ;;
			v) VERBOSE=1 ;;
			N) pass_nvidia ;;
			D) pass_drm ;;
			*) echo "option=$option" ;;
		esac
	done

	# get the items past the flags
	shift "$((OPTIND-1))"
	if [ "$VERBOSE" -eq 1 ]; then echo ">> AFTER_OPTS: '$*'"; fi

	# has_bwrap_args == a double dash is found after the first '--'
	has_bwrap_args=0
	# arguments/items specified *before* the double-dash (could be bwrap args/command)
	group_argv=()
	for option in "$@"; do
		shift 1
		if [ "$option" = "--" ]; then
			has_bwrap_args=1
			break
		fi
		group_argv+=("$option")
	done

	# in case additional bwrap options are used
	# eg.: sunaba.sh -- bwrap -- command
	changed_cwd=0
	pass_next=0
	if [ "$has_bwrap_args" -eq 1 ]; then
		for bwrap_arg in "${group_argv[@]}"; do
			if [ "$pass_next" -ne 0 ]; then
				if [ ! -e "$bwrap_arg" ]; then
					echo "failed: could not resolve '$bwrap_arg'"
					exit 1
				fi

				for _ in $(seq "$pass_next"); do
					argv+=("$bwrap_arg")
				done
				pass_next=0
				continue
			elif [ "$bwrap_arg" = "--pass" ]; then
				argv+=("--bind")
				pass_next=2
				continue
			elif [ "$bwrap_arg" = "--pass-try" ]; then
				argv+=("--bind-try")
				pass_next=2
				continue
			elif [ "$bwrap_arg" = "--ro-pass" ]; then
				argv+=("--ro-bind")
				pass_next=2
				continue
			elif [ "$bwrap_arg" = "--ro-pass-try" ]; then
				argv+=("--ro-bind-try")
				pass_next=2
				continue
			elif [ "$bwrap_arg" = "--chdir" ]; then
				changed_cwd=1
			fi

			argv+=("$bwrap_arg")
		done
	fi

	if [ "$changed_cwd" -eq 0 ]; then
		# default chdir to home dir
		arg chdir "/home/$USER"
	fi

	if [ "$pass_next" -ne 0 ]; then
		echo "failed: trailing option (either --[ro]-pass or --chdir)"
		exit 1
	fi

	# execution phase
	user_command=()
	if [ "$has_bwrap_args" -eq 1 ]; then
		user_command=("$@")
	else
		user_command=("${group_argv[@]}")
	fi
	if [ "$VERBOSE" -eq 1 ]; then echo ">> user_command: '${user_command[*]}'"; fi

	# display help if there is no command to be run
	if [ -z "${user_command[0]}" ]; then print_help; fi

	# execute the command
	if [ "$VERBOSE" -eq 1 ]; then echo ">> ARGV: '${argv[*]} -- ${user_command[*]}'"; fi
	execute "${user_command[@]}"
fi