projects
/
bubblebox.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
improve DISPLAY env var parsing and factor X11 ode into separate function
[bubblebox.git]
/
profiles.py
diff --git
a/profiles.py
b/profiles.py
index 69445f444f91110597c9614724ed8c9fb589bcc3..31528988ec73c32ffd088d50a5383a9397708866 100644
(file)
--- a/
profiles.py
+++ b/
profiles.py
@@
-30,6
+30,15
@@
DEFAULT = group(
}),
)
}),
)
+def X11():
+ display = os.environ["DISPLAY"].removeprefix(":").split('.')[0]
+ return host_access({
+ "/tmp/.X11-unix/": {
+ "X"+display: Access.Read,
+ },
+ os.environ["XAUTHORITY"]: Access.Read,
+ })
+
# https://github.com/igo95862/bubblejail is a good source of paths that need allowing.
# We do not give access to pipewire, that needs a portal (https://docs.pipewire.org/page_portal.html).
def DESKTOP(name):
# https://github.com/igo95862/bubblejail is a good source of paths that need allowing.
# We do not give access to pipewire, that needs a portal (https://docs.pipewire.org/page_portal.html).
def DESKTOP(name):
@@
-37,17
+46,16
@@
def DESKTOP(name):
DEFAULT,
# Share XDG_RUNTIME_DIR among all instances of this sandbox
shared_runtime_dir(name),
DEFAULT,
# Share XDG_RUNTIME_DIR among all instances of this sandbox
shared_runtime_dir(name),
- # Access to
screen
and audio
+ # Access to
display servers, hardware acceleration,
and audio
host_access({
"dev": {
("dri", "snd"): Access.Device,
},
host_access({
"dev": {
("dri", "snd"): Access.Device,
},
- "/tmp/.X11-unix/": Access.Read,
- os.environ["XAUTHORITY"]: Access.Read,
XDG_RUNTIME_DIR: {
XDG_RUNTIME_DIR: {
- (
"wayland*"
, "pulse"): Access.Read,
+ (
os.environ["WAYLAND_DISPLAY"]
, "pulse"): Access.Read,
},
}),
},
}),
+ X11(),
# Access to some key user configuration
home_access({
(".config/fontconfig", ".XCompose", ".local/share/applications"): Access.Read,
# Access to some key user configuration
home_access({
(".config/fontconfig", ".XCompose", ".local/share/applications"): Access.Read,