sandbox-app-launcher

#!/bin/bash

## Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
## See the file COPYING for copying conditions.

main_app_dir="/usr/share/sandbox-app-launcher"
symlink_dir="${main_app_dir}/symlinks"
app_name="${*}"
app_user="sandbox-${app_name}"
app_homedir="${main_app_dir}/${app_name}"
seccomp_filter="${main_app_dir}/seccomp-filter.bpf"
wx_whitelist="${main_app_dir}/wx_whitelist"

if [ -f "/etc/sandbox-app-launcher/${app_name}.conf" ]; then
  . "/etc/sandbox-app-launcher/${app_name}.conf"
fi

setup() {
  if ! [ -d "${main_app_dir}" ]; then
    mkdir -m 755 "${main_app_dir}"
  fi

  if ! [ -d "${symlink_dir}" ]; then
    mkdir -m 755 "${symlink_dir}"
  fi

  if ! getent passwd | sed -e 's/:.*//g' | grep -qw "${app_user}"; then
    useradd -m -d "${app_homedir}" -s /sbin/nologin "${app_user}"
  fi

  if ! [ "$(stat -c %a ${app_homedir})" = "700" ]; then
    chmod 700 -R "${app_homedir}"
  fi

  ## Generate seccomp filter.
  compiler_flags="-lseccomp -ldl -D_GNU_SOURCE -Wdate-time -D_FORTIFY_SOURCE=2 -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wl,-z,relro -Wl,-z,now"

  if ! [ -f "${seccomp_filter}" ]; then
    gcc "${main_app_dir}/seccomp.c" -o "${main_app_dir}/seccomp" ${compiler_flags}
    chmod 700 "${main_app_dir}/seccomp"
    "${main_app_dir}/seccomp"
  fi

  if ! [ -f "${main_app_dir}/seccomp-filter-wx.bpf" ]; then
    cp "${main_app_dir}/seccomp.c" "${main_app_dir}/seccomp-wx.c"
    str_replace "seccomp-filter.bpf" "seccomp-filter-wx.bpf" "${main_app_dir}/seccomp-wx.c" >/dev/null
    str_replace "int w_xor_x = 1" "int w_xor_x = 0" "${main_app_dir}/seccomp-wx.c" >/dev/null
    gcc "${main_app_dir}/seccomp-wx.c" -o "${main_app_dir}/seccomp-wx" ${compiler_flags}
    chmod 700 "${main_app_dir}/seccomp-wx"
    "${main_app_dir}/seccomp-wx"
  fi

  ## Some apps break with W^X so allow opting out.
  if grep -qw "${app_name}" "${wx_whitelist}"; then
    seccomp_filter="${main_app_dir}/seccomp-filter-wx.bpf"
  fi
}

create_symlinks() {
  app_path="$(type -P ${app_name})"

  if ! [ -e "${app_path}" ]; then
    echo "ERROR: Could not find '${app_name}' in \$PATH."
    exit 1
  fi

  if ! [ -e "${symlink_dir}/${app_name}" ]; then
    ln -s "${app_path}" "${symlink_dir}/${app_name}"
  fi
}

run_program() {
  ## TODO: X11 sandbox - not needed if we switch to wayland
  ## TODO: IPC namespace
  ## TODO: Network namespace - probably via ip netns
  ## TODO: Don't preserve the environment - env -i

  ## Some systems do not have /lib{32,64}.
  lib_dir="/lib /lib --ro-bind /usr/lib /usr/lib"
  if [ -d /lib32 ]; then
    lib_dir+=" --ro-bind /lib32 /lib32"
  fi
  if [ -d /lib64 ]; then
    lib_dir+=" --ro-bind /lib64 /lib64"
  fi

  ## Optionally remove network access by creating an empty net namespace.
  if [ "${allow_net}" = "no" ]; then
    bwrap_args+="--unshare-net "
  fi

  sudo -H -u "${app_user}" bash -c "
  bwrap \
  --ro-bind /bin /bin \
  --ro-bind /usr/bin /usr/bin \
  --ro-bind ${lib_dir} \
  --ro-bind /usr/share /usr/share \
  --ro-bind /usr/local/lib /usr/local/lib \
  --ro-bind /usr/local/share /usr/local/share \
  --ro-bind /usr/include /usr/include \
  --ro-bind /etc /etc \
  --ro-bind-data 10 /etc/passwd \
  --ro-bind-data 11 /etc/group \
  --ro-bind ${main_app_dir}/machine-id /etc/machine-id \
  --ro-bind /var/lib /var/lib \
  --ro-bind ${main_app_dir}/machine-id /var/lib/dbus/machine-id \
  --ro-bind /var/log /var/log \
  --ro-bind /sys/devices /sys/devices \
  --ro-bind /sys/class /sys/class \
  --ro-bind /sys/bus /sys/bus \
  --ro-bind /sys/fs/cgroup /sys/fs/cgroup \
  --tmpfs ${main_app_dir} \
  --bind ${app_homedir} ${app_homedir} \
  --ro-bind ${symlink_dir}/${app_name} ${symlink_dir}/${app_name} \
  --remount-ro ${main_app_dir} \
  --proc /proc \
  --tmpfs /tmp \
  --tmpfs /var/tmp \
  --tmpfs /var/cache \
  --tmpfs /var/run \
  --tmpfs /run \
  --dev /dev \
  --chdir ${app_homedir} \
  --setenv HOME ${app_homedir} \
  --setenv USER ${app_user} \
  --setenv LOGNAME ${app_user} \
  --setenv XAUTHORITY ${app_homedir}/.Xauthority \
  --setenv SHELL /sbin/nologin \
  --unsetenv SUDO_USER \
  --unsetenv SUDO_UID \
  --unsetenv SUDO_GID \
  --unsetenv SUDO_COMMAND \
  --unsetenv OLDPWD \
  --unsetenv MAIL \
  --unshare-pid \
  --unshare-cgroup \
  --unshare-uts \
  --hostname host \
  --new-session \
  --cap-drop all \
  --seccomp 12 \
  10< <(getent passwd root ${app_user} nobody) \
  11< <(getent group root ${app_user} nobody) \
  12< ${seccomp_filter} \
  ${bwrap_args} \
  ${symlink_dir}/${app_name}"
}

setup
create_symlinks
run_program