global.yml

use: [common, private-home]
command: [bash]
rules:
  common:
    - >-
      Apply common restrictions such as limiting access to environment
      variables and the file system while still allowing basic programs to
      operate correctly.

    - args: [--clearenv, --unshare-pid]
    - die-with-parent: true
    # More restrictive options to consider.
    # - args: [--unshare-uts, --unshare-ipc, --unshare-user, --unshare-cgroup]
    - proc: /proc
    - dev: /dev
    - tmpfs: /tmp
    - restrict-tty:
    - env: {PATH: /usr/bin:/bin}
    - env: [LANG, XDG_RUNTIME_DIR, XDG_SESSION_TYPE, TERM, HOME, LOGNAME, USER,
            EDITOR, SANDBOX]
    - bind: /etc
    - symlink: [/usr/lib, /lib]
    - symlink: [/usr/lib64, /lib64]
    - bind: /usr/lib
    - bind: /usr/lib64
    - bind: {path: /usr/libexec, try: true}
    - bind: /usr/bin
    - bind: /usr/share
    - bind: /usr/include
    - symlink: [usr/bin, /bin]
    - symlink: [usr/bin, /sbin]
    - tmpfs: {path: $XDG_RUNTIME_DIR, perms: 0o700}
    - file: $XDG_RUNTIME_DIR/flatpak-info
    - file: /.flatpak-info
    - bind: {path: /run/systemd/resolve, try: true}

  downloads:
    - Bind the user's Downloads directory.
    - bind: {path: $HOME/Downloads, read-write: true}

  make-home:
    - Create some default directories in home.
    - dir: $HOME/.config
    - dir: $HOME/.cache
    - dir: $HOME/.local/share

  data-home:
    - Mounts a readable data directory at /sandbox-data
    - bind:
        path: $SANDBOX_HOME
        dst: /sandbox-data
        try: true
    - env: {SANDBOX_DATA: /sandbox-data}

  private-home:
    - Creates a private writable home directory.
    - bind:
        path: $SANDBOX_HOME
        dst: $HOME
        read-write: true
        skel: $HOME

    - use: [make-home]

  tmp-home:
    - Creates a temporary home directory.
    - tmp-overlay: {path: $HOME, skel: true}
    - env: {debian_chroot: $SANDBOX}
    - use: [make-home]

  cli:
    - Enables typical Command Line Interface options.
    - use: [common, data-home, cwd]

  gui:
    - Enables typical Graphical User Interface options.
    - use: [common, x11, wayland, audio, dbus, accessibility]

  shell:
    - Options for a temporary shell with typical CLI and GUI options.
    - use: [gui, tmp-home, cwd]

  cwd:
    - Bind the current directory with write permission.
    - bind: {cwd: true, read-write: true}

  x11:
    - Allow access to an X11 display.
    - ifdef:
      - DISPLAY
      - env: DISPLAY
      - bind: /tmp/.X11-unix/
    - ifdef:
      - XAUTHORITY
      - env: XAUTHORITY
      - bind: $XAUTHORITY

  wayland:
    - Allow access to Wayland.
    - ifdef:
      - WAYLAND_DISPLAY
      - env: WAYLAND_DISPLAY
      - bind: $XDG_RUNTIME_DIR/$WAYLAND_DISPLAY

  audio:
    - Enables pulseaudio or pipewire.
    - bind: $XDG_RUNTIME_DIR/pulse/native
    - bind: {path: $HOME/.config/pulse/cookie, try: true}
    - bind: {path: $XDG_RUNTIME_DIR/pipewire-0, try: true}
    - bind: {path: /dev/snd, dev: true, try: true}

  video:
    - Enables access to video devices.
    - bind: {path: /dev/v4l, dev: true}
    - bind: {path: /dev/video0, dev: true, try: true}
    - bind: {path: /dev/video1, dev: true, try: true}
    - bind: {path: /dev/video2, dev: true, try: true}
    - bind: {path: /dev/video3, dev: true, try: true}

  accessibility:
    - Enables dbus accessibility calls.
    - dbus: {allow: call, path: 'org.a11y.Bus.*=*'}
    - bind: {path: $XDG_RUNTIME_DIR/at-spi, try: true}

  dbus:
    - >-
      Enables limited dbus access through XDG Desktop Portal.
      It allows access to files outside the sandbox but only via the
      systems file selection dialog.  As well as, printing and screen
      sharing services.
    - dbus: {allow: talk, path: org.freedesktop.portal.Documents}
    - dbus: {allow: talk, path: org.freedesktop.portal.Flatpak}
    - dbus: {allow: talk, path: org.freedesktop.portal.Desktop}
    - dbus: {allow: talk, path: org.freedesktop.portal.FileChooser}
    - dbus: {allow: talk, path: org.freedesktop.portal.Print}
    - dbus: {allow: talk, path: org.freedesktop.portal.Camera}
    - dbus: {allow: talk, path: org.freedesktop.portal.Device}
    - dbus: {allow: talk, path: org.freedesktop.portal.*}
    - dbus:
        allow: broadcast
        path: org.freedesktop.portal.Desktop=org.freedesktop.portal.Settings.SettingChanged@/org/freedesktop/portal/desktop
    - bind:
        path: $XDG_RUNTIME_DIR/doc/by-app/$APP_NAME
        dst: $XDG_RUNTIME_DIR/doc
        read-write: true
        try: true

  gpu:
    - Enables GPU access.
    - use: [nvidia]
    - bind: {path: /dev/dri, dev: true}
    - bind: /sys/dev/char
    - bind: /sys/devices

  usb:
    - Enables USB access.
    - bind: {path: /dev/usb}
    - bind: {path: /dev/bus/usb}
    - bind: {path: /sys/bus/usb/devices}

  nvidia:
    - Enables access to NVidia GPU device.
    - bind: {path: /dev/nvidiactl,        dev: true, try: true}
    - bind: {path: /dev/nvidia-uvm,       dev: true, try: true}
    - bind: {path: /dev/nvidia-uvm-tools, dev: true, try: true}
    - bind: {path: /dev/nvidia-modeset,   dev: true, try: true}
    - bind: {path: /dev/nvidia-caps,      dev: true, try: true}
    - bind: {path: /dev/nvidia0,          dev: true, try: true}
    - bind: {path: /dev/nvidia1,          dev: true, try: true}
    - bind: {path: /sys/module/nvidia,    try: true}

  firefox:
    - A special rule for running the Firefox web browser.
    - ifdef:
      - WAYLAND_DISPLAY
      - env: {MOZ_ENABLE_WAYLAND: 1}
    - dbus: {allow: own, path: org.mozilla.firefox.*}

  gthumb:
    - A special rule for running the GThumb image viewer.
    - dbus: {allow: own, path: org.gnome.gThumb.*}

  transmission:
    - Allow access to Transmission bittorrent client
    - dbus: {allow: call, path: com.transmissionbt.Transmission.*=*}