43 lines
1.5 KiB
Bash
43 lines
1.5 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
DBPROXYID=$(echo $RANDOM | base64)
|
|
DBPROXYPATH="/run/user/$UID/.dbus-proxy"
|
|
|
|
if [[ ! -d "$DBPROXYPATH" ]]
|
|
then
|
|
mkdir "$DBPROXYPATH"
|
|
fi
|
|
|
|
## zypak expects a dbus socket, so we use a proxy to isolate the real one
|
|
xdg-dbus-proxy unix:path=/run/user/"$UID"/bus /run/user/"$UID"/.dbus-proxy/session-bus-proxy-"$DBPROXYID" &
|
|
|
|
(
|
|
exec bwrap \
|
|
--ro-bind /usr/bin /usr/bin \
|
|
--ro-bind /usr/share/ /usr/share/ \
|
|
--ro-bind /usr/lib /usr/lib \
|
|
--ro-bind /lib /lib \
|
|
--ro-bind /lib64 /lib64 \
|
|
--proc /proc \
|
|
--dev /dev \
|
|
--ro-bind /etc /etc \
|
|
--ro-bind /run/user/"$(id -u)"/"$WAYLAND_DISPLAY" /run/user/"$(id -u)"/"$WAYLAND_DISPLAY" \
|
|
--ro-bind /run/user/"$(id -u)"/pipewire-0 /run/user/"$(id -u)"/pipewire-0 \
|
|
--ro-bind /run/user/"$(id -u)"/pulse /run/user/"$(id -u)"/pulse \
|
|
--bind /run/user/"$(id -u)"/.dbus-proxy/session-bus-proxy-"$DBPROXYID" /run/user/"$(id -u)"/bus \
|
|
--bind ~/.config/Signal ~/.config/Signal \
|
|
--unshare-pid \
|
|
--unshare-ipc \
|
|
--unshare-uts \
|
|
--unshare-cgroup \
|
|
--new-session \
|
|
--seccomp 10 \
|
|
10< /usr/local/bin/seccomp_default_filter.bpf \
|
|
/usr/bin/zypak-wrapper signal-desktop --enable-features=UseOzonePlatform --ozone-platform=wayland
|
|
)
|
|
|
|
## other electron apps may require a different startup for zypak, like:
|
|
# /usr/bin/zypak-wrapper electron19 /usr/lib/MYELECTRONAPP --enable-features=UseOzonePlatform -ozone-platform=wayland
|
|
|