Skip to content

Commit d5bf26b

Browse files
ivan-hcivan-hc
authored
Merge pull request #696 from ivan-hc/dev
Improve "sandbox" thanks to a free and more open selection of directories to authorize access to
2 parents 0d2f539 + 2ec0845 commit d5bf26b

File tree

4 files changed

+165
-137
lines changed

4 files changed

+165
-137
lines changed

‎APP-MANAGER‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#!/usr/bin/env bash
22

3-
AMVERSION="6.13"
3+
AMVERSION="6.14"
44

55
# Determine main repository and branch
66
AMREPO="https://raw.githubusercontent.com/ivan-hc/AM/main"

‎README.md‎

Lines changed: 35 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,10 @@ You can consult the entire **list of managed apps** at [**portable-linux-apps.gi
4646
- [AppImages from external media](#appimages-from-external-media)
4747
- [How to use "AM" in non-privileged mode, like "AppMan"](#how-to-use-am-in-non-privileged-mode-like-appman)
4848
- [Sandbox an AppImage](#sandbox-an-appimage)
49+
- [How to enable a sandbox](#how-to-enable-a-sandbox)
50+
- [How to disable a sandbox](#how-to-disable-a-sandbox)
51+
- [Sandboxing example](#sandboxing-example)
52+
- [About Aisap sandboxing](#about-aisap-sandboxing)
4953
- [How to enable bash completion](#how-to-enable-bash-completion)
5054
- [How to update or remove apps manually](#how-to-update-or-remove-apps-manually)
5155
- [Downgrade an installed app to a previous version](#downgrade-an-installed-app-to-a-previous-version)
@@ -708,6 +712,10 @@ This section is committed to giving small demonstrations of each available optio
708712
- [AppImages from external media](#appimages-from-external-media)
709713
- [How to use "AM" in non-privileged mode, like "AppMan"](#how-to-use-am-in-non-privileged-mode-like-appman)
710714
- [Sandbox an AppImage](#sandbox-an-appimage)
715+
- [How to enable a sandbox](#how-to-enable-a-sandbox)
716+
- [How to disable a sandbox](#how-to-disable-a-sandbox)
717+
- [Sandboxing example](#sandboxing-example)
718+
- [About Aisap sandboxing](#about-aisap-sandboxing)
711719
- [How to enable bash completion](#how-to-enable-bash-completion)
712720
- [How to update or remove apps manually](#how-to-update-or-remove-apps-manually)
713721
- [Downgrade an installed app to a previous version](#downgrade-an-installed-app-to-a-previous-version)
@@ -908,8 +916,15 @@ This is very useful if you have large AppImage packages that you necessarily nee
908916

909917
__________________________________________________________________________
910918
### Sandbox an AppImage
911-
Since version 5.3 you can use the `--sandbox` option to run AppImages using a sandbox, and since version 6.12 Firejails has been dropped in favour of "[Aisap](https://github.com/mgord9518/aisap)", a [Bubblewrap](https://github.com/containers/bubblewrap) frontend for AppImages.
919+
Since version 6.12, "AM"/"AppMan" uses Bubblewrap for sandboxing AppImage packages, thanks to "[Aisap](https://github.com/mgord9518/aisap)", a highly intuitive and configurable command line solution.
912920

921+
The option "`--sandbox`", which since version 5.3 was using Firejail, has taken on a completely different appearance and usability, thanks to the intense work of @Samueru-sama, who managed to extend and enhance "Aisap", making it extremely easy to use in our project, to the point of making us forget that we are using a command line utility.
922+
923+
[Bubblewrap](https://github.com/containers/bubblewrap) is an highly used sanboxing solution, used in multiple projects for GNU/Linux, including Flatpak.
924+
925+
In this sense, "Aisap" may be considered a reference point for the future of AppImages sandboxing!
926+
927+
#### How to enable a sandbox
913928
This method works as follows:
914929
```
915930
am --sandbox $APP
@@ -918,21 +933,32 @@ or
918933
```
919934
appman --sandbox $APP
920935
```
921-
- if the "aisap" package is not installed, you will be asked if you want to install it via "AM"/AppMan;
922-
- you will be asked if your AppImages can have access to the main XDG directories (Pictures, Videos, Documents... using the system language);
923-
- requires replacing the symlink in $PATH with a script ("AM" users will need the root password);
924-
- to work, the Appimage will be set to "not executable", and the AM-updater will also have its `chmod` command set to `a-x` instead of `a+x`.
936+
The "aisap" package installed is required, whether it is available system-wide ("AM") or locally ("AppMan"), the important thing is that the "aisap" command is in $PATH. If it is not present, "AM"/"AppMan" will ask you if it can proceed with the installation before continuing.
925937

926-
The default location for the sandboxed homes is at $HOME/.local/am-sandboxes, but that location can be changed by setting the $SANDBOXDIR env variable.
938+
We will first compile the Aisap script in a non-privileged, easy-to-access directory, before being placed in $PATH (see step 2, below).
939+
1. Once started, you will be asked whether to enable the sandbox (default "Y") or not (type "N"):
940+
- the main XDG directories (Pictures, Videos, Documents...) will be listed, answer whether to authorize access (type "Y") or not ("N", default);
941+
- at the end, choose whether to specify some directories to access (default "N"), and if "Yes", write the path.
942+
2. Now that the script is complete, it should be placed in $PATH. "AM" users will need to authorize writing to /usr/local/bin by entering their password. "AppMan" users do not have these problems;
943+
3. To allow Aipman take care of the AppImage, the latter be set to "not executable" and the related AM-updater will also have its `chmod` command set from `a+x` to `a-x`.
944+
4. Now your AppImage is in a sandbox!
927945

928-
To restore the use of the AppImage without sandbox, you need to run the application command with the "--disable-sandbox" option:
946+
NOTE, the default location for the sandboxed homes is at $HOME/.local/am-sandboxes, but that location can be changed by setting the $SANDBOXDIR environemt variable.
947+
948+
#### How to disable a sandbox
949+
To remove the sandbox just run the command of the AppImage with the flag "--disable-sandbox", like this:
929950
```
930951
$APP --disable-sandbox
931952
```
932-
In the video we will use "Baobab" (GTK3 version), a disk space analyzer, available in the database as "baobab-gtk3", and giving it read/write permissions only in "Video" (the Italian for "Videos") :
933953

934-
https://github.com/ivan-hc/AM/assets/88724353/79c1b4af-53d8-4175-9a28-136804059f6e
954+
#### Sandboxing example
955+
In the video below we will use "Baobab" (GTK3 version), a disk space analyzer, available in the database as "baobab-gtk3".
956+
957+
Among the XDG directories we will authorize "Images" (Pictures) and "Videos" (Videos), while manually we will authorize "Public". The test will be carried out in normal mode, then in sandbox and again without sandbox:
958+
959+
https://github.com/ivan-hc/AM/assets/88724353/dd193943-7b08-474a-bbbb-4a6906de8b24
935960

961+
#### About Aisap sandboxing
936962
For more information about "Aisap", visit https://github.com/mgord9518/aisap
937963

938964
Available profiles are listed at https://github.com/mgord9518/aisap/tree/main/profiles

‎modules/sandboxes.am‎

Lines changed: 69 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -72,22 +72,25 @@ case "$1" in
7272
# Check if we are using AM or AppMan
7373
printf '\n%s\n' " Making aisap script for \"$(echo "$AMCLI" | tr a-z A-Z)\"..."
7474

75+
[ -z "$AMCACHEDIR" ] && exit 1
7576
rm -Rf "$AMCACHEDIR/sandbox-scripts"
7677
mkdir -p "$AMCACHEDIR/sandbox-scripts"
7778

7879
# Get xdg variables
80+
XDG_DESKTOP_DIR="$(xdg-user-dir DESKTOP 2>/dev/null)"
81+
XDG_DOCUMENTS_DIR="$(xdg-user-dir DOCUMENTS 2>/dev/null)"
7982
XDG_DOWNLOAD_DIR="$(xdg-user-dir DOWNLOAD 2>/dev/null)"
8083
XDG_MUSIC_DIR="$(xdg-user-dir MUSIC 2>/dev/null)"
8184
XDG_PICTURES_DIR="$(xdg-user-dir PICTURES 2>/dev/null)"
8285
XDG_VIDEOS_DIR="$(xdg-user-dir VIDEOS 2>/dev/null)"
83-
XDG_DOCUMENTS_DIR="$(xdg-user-dir DOCUMENTS 2>/dev/null)"
8486

8587
# Unset the xdg variable if it equals to $HOME
88+
if [ "$XDG_DESKTOP_DIR" = "$HOME" ] || [ "$XDG_DESKTOP_DIR" = "$HOME/" ]; then XDG_DESKTOP_DIR=""; fi
89+
if [ "$XDG_DOCUMENTS_DIR" = "$HOME" ] || [ "$XDG_DOCUMENTS_DIR" = "$HOME/" ]; then XDG_DOCUMENTS_DIR=""; fi
8690
if [ "$XDG_DOWNLOAD_DIR" = "$HOME" ] || [ "$XDG_DOWNLOAD_DIR" = "$HOME/" ]; then XDG_DOWNLOAD_DIR=""; fi
8791
if [ "$XDG_MUSIC_DIR" = "$HOME" ] || [ "$XDG_MUSIC_DIR" = "$HOME/" ]; then XDG_MUSIC_DIR=""; fi
8892
if [ "$XDG_PICTURES_DIR" = "$HOME" ] || [ "$XDG_PICTURES_DIR" = "$HOME/" ]; then XDG_PICTURES_DIR=""; fi
8993
if [ "$XDG_VIDEOS_DIR" = "$HOME" ] || [ "$XDG_VIDEOS_DIR" = "$HOME/" ]; then XDG_VIDEOS_DIR=""; fi
90-
if [ "$XDG_DOCUMENTS_DIR" = "$HOME" ] || [ "$XDG_DOCUMENTS_DIR" = "$HOME/" ]; then XDG_DOCUMENTS_DIR=""; fi
9194

9295
cat <<-"HEREDOC" >> "$AMCACHEDIR/sandbox-scripts/$2"
9396
#!/bin/sh
@@ -111,17 +114,21 @@ case "$1" in
111114
CONFIGDIR="${XDG_CONFIG_HOME:-$HOME/.config}"
112115
CACHEDIR="${XDG_CACHE_HOME:-$HOME/.cache}"
113116
117+
XDG_DESKTOP_DIR="$(xdg-user-dir DESKTOP 2>/dev/null)"
118+
XDG_DOCUMENTS_DIR="$(xdg-user-dir DOCUMENTS 2>/dev/null)"
114119
XDG_DOWNLOAD_DIR="$(xdg-user-dir DOWNLOAD 2>/dev/null)"
120+
XDG_GAMES_DIR="$(xdg-user-dir GAMES 2>/dev/null)"
115121
XDG_MUSIC_DIR="$(xdg-user-dir MUSIC 2>/dev/null)"
116122
XDG_PICTURES_DIR="$(xdg-user-dir PICTURES 2>/dev/null)"
117123
XDG_VIDEOS_DIR="$(xdg-user-dir VIDEOS 2>/dev/null)"
118-
XDG_DOCUMENTS_DIR="$(xdg-user-dir DOCUMENTS 2>/dev/null)"
119124
125+
if [ "$XDG_DESKTOP_DIR" = "$HOME" ] || [ "$XDG_DESKTOP_DIR" = "$HOME/" ]; then XDG_DESKTOP_DIR=""; fi
126+
if [ "$XDG_DOCUMENTS_DIR" = "$HOME" ] || [ "$XDG_DOCUMENTS_DIR" = "$HOME/" ]; then XDG_DOCUMENTS_DIR=""; fi
120127
if [ "$XDG_DOWNLOAD_DIR" = "$HOME" ] || [ "$XDG_DOWNLOAD_DIR" = "$HOME/" ]; then XDG_DOWNLOAD_DIR=""; fi
128+
if [ "$XDG_GAMES_DIR" = "$HOME" ] || [ "$XDG_GAMES_DIR" = "$HOME/" ]; then XDG_GAMES_DIR=""; fi
121129
if [ "$XDG_MUSIC_DIR" = "$HOME" ] || [ "$XDG_MUSIC_DIR" = "$HOME/" ]; then XDG_MUSIC_DIR=""; fi
122130
if [ "$XDG_PICTURES_DIR" = "$HOME" ] || [ "$XDG_PICTURES_DIR" = "$HOME/" ]; then XDG_PICTURES_DIR=""; fi
123131
if [ "$XDG_VIDEOS_DIR" = "$HOME" ] || [ "$XDG_VIDEOS_DIR" = "$HOME/" ]; then XDG_VIDEOS_DIR=""; fi
124-
if [ "$XDG_DOCUMENTS_DIR" = "$HOME" ] || [ "$XDG_DOCUMENTS_DIR" = "$HOME/" ]; then XDG_DOCUMENTS_DIR=""; fi
125132
126133
# Try to find the right name of the app xdg directories, as sometimes it is not the same as $APPNAME
127134
APPDATA=$( ls "$DATADIR" | grep -i "$APPNAME" | head -1 )
@@ -159,41 +166,75 @@ case "$1" in
159166
--add-file "$CONFIGDIR"/Kvantum \
160167
--add-file "$HOME"/.local/lib \
161168
--add-file /usr/share \
169+
--rm-file /path/to/nothing \
170+
--rm-file "${XDG_DESKTOP_DIR:-~/Desktop}" \
171+
--rm-file "${XDG_DOCUMENTS_DIR:-~/Documents}" \
162172
--rm-file "${XDG_DOWNLOAD_DIR:-~/Downloads}" \
173+
--rm-file "${XDG_GAMES_DIR:-~/Games}" \
163174
--rm-file "${XDG_MUSIC_DIR:-~/Music}" \
164175
--rm-file "${XDG_PICTURES_DIR:-~/Pictures}" \
165176
--rm-file "${XDG_VIDEOS_DIR:-~/Videos}" \
166-
--rm-file "${XDG_DOCUMENTS_DIR:-~/Documents}" \
177+
--add-file /var/lib/dbus \
178+
--add-file /tmp/dbus* \
179+
--add-socket pulseaudio \
167180
--add-socket dbus \
181+
--add-socket network \
168182
--add-socket x11 \
169183
--add-socket wayland \
170-
--add-socket pulseaudio \
171-
--add-socket network \
172184
--add-device dri -- \
173185
"$APPEXEC" "$@"
174186
HEREDOC
175-
printf '\033[36m\n'
176-
read -p " Allow $2 access to ${XDG_DOWNLOAD_DIR:-~/Downloads}? (y/N): " yn
177-
if echo "$yn" | grep -i '^y' >/dev/null 2>&1; then
178-
sed -i 's|--rm-file "${XDG_DOWNLOAD_DIR:-~/Downloads}"|--add-file "${XDG_DOWNLOAD_DIR:-~/Downloads}":rw|g' "$AMCACHEDIR/sandbox-scripts/$2" || exit 1
179-
fi
180-
read -p " Allow $2 access to ${XDG_DOCUMENTS_DIR:-~/Documents}? (y/N): " yn
181-
if echo "$yn" | grep -i '^y' >/dev/null 2>&1; then
182-
sed -i 's|--rm-file "${XDG_DOCUMENTS_DIR:-~/Documents}"|--add-file "${XDG_DOCUMENTS_DIR:-~/Documents}":rw|g' "$AMCACHEDIR/sandbox-scripts/$2" || exit 1
183-
fi
184-
read -p " Allow $2 access to ${XDG_MUSIC_DIR:-~/Music} (y/N): " yn
185-
if echo "$yn" | grep -i '^y' >/dev/null 2>&1; then
186-
sed -i 's|--rm-file "${XDG_MUSIC_DIR:-~/Music}"|--add-file "${XDG_MUSIC_DIR:-~/Music}":rw|g' "$AMCACHEDIR/sandbox-scripts/$2" || exit 1
187-
fi
188-
read -p " Allow $2 access to ${XDG_PICTURES_DIR:-~/Pictures} (y/N): " yn
189-
if echo "$yn" | grep -i '^y' >/dev/null 2>&1; then
190-
sed -i 's|--rm-file "${XDG_PICTURES_DIR:-~/Pictures}"|--add-file "${XDG_PICTURES_DIR:-~/Pictures}":rw|g' "$AMCACHEDIR/sandbox-scripts/$2" || exit 1
191-
fi
192-
read -p " Allow $2 access to ${XDG_VIDEOS_DIR:-~/Videos} (y/N): " yn
193-
if echo "$yn" | grep -i '^y' >/dev/null 2>&1; then
194-
sed -i 's|--rm-file "${XDG_VIDEOS_DIR:-~/Videos}"|--add-file "${XDG_VIDEOS_DIR:-~/Videos}":rw|g' "$AMCACHEDIR/sandbox-scripts/$2" || exit 1
187+
printf '\033[33m\n'
188+
read -p " Do you want configure access to directories? (Y/n): " yn
189+
if ! echo "$yn" | grep -i '^n' >/dev/null 2>&1; then
190+
printf '\033[36m\n'
191+
read -p " Allow $2 access to ${XDG_DESKTOP_DIR:-~/Desktop}? (y/N): " yn
192+
if echo "$yn" | grep -i '^y' >/dev/null 2>&1; then
193+
sed -i 's|--rm-file "${XDG_DESKTOP_DIR:-~/Desktop}"|--add-file "${XDG_DESKTOP_DIR:-~/Desktop}":rw|g' "$AMCACHEDIR/sandbox-scripts/$2" || exit 1
194+
fi
195+
read -p " Allow $2 access to ${XDG_DOCUMENTS_DIR:-~/Documents}? (y/N): " yn
196+
if echo "$yn" | grep -i '^y' >/dev/null 2>&1; then
197+
sed -i 's|--rm-file "${XDG_DOCUMENTS_DIR:-~/Documents}"|--add-file "${XDG_DOCUMENTS_DIR:-~/Documents}":rw|g' "$AMCACHEDIR/sandbox-scripts/$2" || exit 1
198+
fi
199+
read -p " Allow $2 access to ${XDG_DOWNLOAD_DIR:-~/Downloads}? (y/N): " yn
200+
if echo "$yn" | grep -i '^y' >/dev/null 2>&1; then
201+
sed -i 's|--rm-file "${XDG_DOWNLOAD_DIR:-~/Downloads}"|--add-file "${XDG_DOWNLOAD_DIR:-~/Downloads}":rw|g' "$AMCACHEDIR/sandbox-scripts/$2" || exit 1
202+
fi
203+
read -p " Allow $2 access to ${XDG_GAMES_DIR:-~/Games} (y/N): " yn
204+
if echo "$yn" | grep -i '^y' >/dev/null 2>&1; then
205+
sed -i 's|--rm-file "${XDG_GAMES_DIR:-~/Games}"|--add-file "${XDG_GAMES_DIR:-~/Games}":rw|g' "$AMCACHEDIR/sandbox-scripts/$2" || exit 1
206+
fi
207+
read -p " Allow $2 access to ${XDG_MUSIC_DIR:-~/Music} (y/N): " yn
208+
if echo "$yn" | grep -i '^y' >/dev/null 2>&1; then
209+
sed -i 's|--rm-file "${XDG_MUSIC_DIR:-~/Music}"|--add-file "${XDG_MUSIC_DIR:-~/Music}":rw|g' "$AMCACHEDIR/sandbox-scripts/$2" || exit 1
210+
fi
211+
read -p " Allow $2 access to ${XDG_PICTURES_DIR:-~/Pictures} (y/N): " yn
212+
if echo "$yn" | grep -i '^y' >/dev/null 2>&1; then
213+
sed -i 's|--rm-file "${XDG_PICTURES_DIR:-~/Pictures}"|--add-file "${XDG_PICTURES_DIR:-~/Pictures}":rw|g' "$AMCACHEDIR/sandbox-scripts/$2" || exit 1
214+
fi
215+
read -p " Allow $2 access to ${XDG_VIDEOS_DIR:-~/Videos} (y/N): " yn
216+
if echo "$yn" | grep -i '^y' >/dev/null 2>&1; then
217+
sed -i 's|--rm-file "${XDG_VIDEOS_DIR:-~/Videos}"|--add-file "${XDG_VIDEOS_DIR:-~/Videos}":rw|g' "$AMCACHEDIR/sandbox-scripts/$2" || exit 1
218+
fi
219+
printf '\033[31m'
220+
read -p " Allow $2 access to a specific directory? (y/N): " yn
221+
if echo "$yn" | grep -i '^y' >/dev/null 2>&1; then
222+
printf '\n%s\n' " Warning: giving access to all of $HOME or / and similar is not safe"
223+
printf '%s\n\033[33m' " Also aisap might not let the application start when such paths are given"
224+
printf '\n%s\n' " Type the path to the directory"
225+
read -p " Example /media/external-drive or ~/Backups: " NEWDIR
226+
[ -z "$NEWDIR" ] && printf '\033[31m\n%s\n' " No path given, aborting" && exit 1
227+
if [ "$NEWDIR" = '$HOME' ] || [ "$NEWDIR" = '$HOME/' ] || [ "$NEWDIR" = "~/" ] || [ "$NEWDIR" = "~" ] \
228+
|| [ "$NEWDIR" = "/" ] || [ "$NEWDIR" = "/home" ] || [ "$NEWDIR" = "/home" ] || [ "$NEWDIR" = "/home/" ]; then
229+
notify-send -u critical "DO YOU WANT THE FBI TO GET YA?"
230+
printf '\033[31m%s\n' && read -p " SPOOKY LOCATION DETECTED! ARE YOU SURE? IF SO TYPE \"YES\": "
231+
[ $YES != "YES" ] && echo "That's not a \"YES\", aborting" && exit 1
232+
fi
233+
printf '\n%s\n' " Giving access to \"$NEWDIR\"..."
234+
sed -i "s|--rm-file /path/to/nothing|--add-file $NEWDIR:rw|g" "$AMCACHEDIR/sandbox-scripts/$2" || exit 1
235+
fi
236+
printf '\n\033[32m%s\n' " User directories access configured successfully!"
195237
fi
196-
printf '\n\033[33m%s\n' " User directories access configured successfully!"
197238

198239
chmod a+x "$AMCACHEDIR/sandbox-scripts/$2" && sed -i "s|DUMMY|$APPIMAGE|g; s|SUDO |$SUDOCOMMAND |g" "$AMCACHEDIR/sandbox-scripts/$2" || exit 1
199240

0 commit comments

Comments
 (0)