minor improvements

profiles/evince

@@ -10,7 +10,7 @@ set -euo pipefail
      --proc /proc \
      --dev /dev \
      --ro-bind /etc/fonts /etc/fonts \
-     --ro-bind /run/user/"$(id -u)"/wayland-0 /run/user/"$(id -u)"/wayland-0 \
+     --ro-bind /run/user/"$(id -u)"/wayland-1 /run/user/"$(id -u)"/wayland-1 \
      --ro-bind ~/.cache/fontconfig ~/.cache/fontconfig \
      --ro-bind ~/.config/evince ~/.config/evince \
      --ro-bind "${@: -1}" ~/"$(basename "${@: -1}")" \

profiles/imv

@@ -9,8 +9,8 @@ set -euo pipefail
      --symlink /usr/lib64 /lib64 \
      --proc /proc \
      --dev /dev \
-     --ro-bind /run/user/"$(id -u)"/wayland-0 /run/user/"$(id -u)"/wayland-0 \
-     --ro-bind "${@: -1}" ~/"$(basename "${@: -1}")" \
+     --ro-bind /run/user/"$(id -u)"/wayland-1 /run/user/"$(id -u)"/wayland-1 \
+     --ro-bind "$PWD" "$PWD" \
      --unshare-user \
      --unshare-pid \
      --unshare-net \

profiles/libreoffice

@@ -9,17 +9,13 @@ set -euo pipefail
      --symlink /usr/lib64 /lib64 \
      --symlink /usr/bin /bin \
      --proc /proc \
-     --dev /dev \
      --tmpfs /tmp \
-     --ro-bind /run/user/"$(id -u)"/wayland-0 /run/user/"$(id -u)"/wayland-0 \
      --ro-bind /etc /etc \
-     --ro-bind /sys /sys \
-     --unsetenv DBUS_SESSION_BUS_ADDRESS \
+     --ro-bind /run/systemd/userdb /run/systemd/userdb \
+     --ro-bind /run/user/"$(id -u)"/wayland-1 /run/user/"$(id -u)"/wayland-1 \
      --bind ~/.cache/fontconfig ~/.cache/fontconfig \
      --bind ~/.config/libreoffice ~/.config/libreoffice \
-     --bind ~/Documents ~/Documents \
      --bind "${@: -1}" "${@: -1}" \
-     --chdir ~/Documents \
      --unshare-all \
      --new-session \
      --seccomp 10 \

profiles/wip/imv-private

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+set -euo pipefail
+(
+    exec bwrap \
+     --ro-bind /usr/bin/ /usr/bin/ \
+     --ro-bind /usr/share /usr/share \
+     --ro-bind /usr/lib /usr/lib \
+     --ro-bind /usr/lib64 /usr/lib64 \
+     --symlink /usr/lib64 /lib64 \
+     --proc /proc \
+     --dev /dev \
+     --ro-bind /run/user/"$(id -u)"/wayland-1 /run/user/"$(id -u)"/wayland-1 \
+     --ro-bind "${@: -1}" ~/"$(basename "${@: -1}")" \
+     --unshare-user \
+     --unshare-pid \
+     --unshare-net \
+     --unshare-uts \
+     --unshare-cgroup \
+     --new-session \
+     --seccomp 10 \
+     10< /usr/local/bin/seccomp_default_filter.bpf \
+     /usr/bin/imv-wayland "$@"
+)

profiles/zathura

@@ -8,7 +8,7 @@ set -euo pipefail
      --ro-bind /usr/lib64 /usr/lib64 \
      --symlink /usr/lib64 /lib64 \
      --proc /proc \
-     --ro-bind /run/user/"$(id -u)"/wayland-0 /run/user/"$(id -u)"/wayland-0 \
+     --ro-bind /run/user/"$(id -u)"/wayland-1 /run/user/"$(id -u)"/wayland-1 \
      --ro-bind /etc/fonts /etc/fonts \
      --ro-bind ~/.config/zathura ~/.config/zathura \
      --ro-bind ~/.cache/fontconfig ~/.cache/fontconfig \