X-Git-Url: https://git.ralfj.de/bubblebox.git/blobdiff_plain/9688cc0c73f7582302cdc8fa1efdc81e2c472c7e..2852b9f44cd053bab63c0d063fdcfeb84e41a2c4:/bubblebox.py?ds=inline

diff --git a/bubblebox.py b/bubblebox.py
index a806e09..5b82322 100644
--- a/bubblebox.py
+++ b/bubblebox.py
@@ -53,12 +53,19 @@ class DbusProxyDirective:
         bwrap.dbus_proxy_flags.extend(self.dbus_proxy_flags)
     def launch_dbus_proxy(bwrap):
         """Finalizer that launches a d-bus proxy with the flags accumulated in `bwrap`."""
+        # For the system bus, we assume it to be at a fixed location and provide it to the sandbox at that same location.
+        # For the session bus, we tell the proxy to talk to DBUS_SESSION_BUS_ADDRESS on the host, but we always put it
+        # at `$XDG_RUNTIME_DIR/bus` in the sandbox.
+        session_bus = XDG_RUNTIME_DIR + "/bus" # how the sandbox will see the bus
+        system_bus = "/run/dbus/system_bus_socket"
+        session_bus_proxy = BUBBLEBOX_DIR + "/bus-" + randname()
+        system_bus_proxy = BUBBLEBOX_DIR + "/bus-system-" + randname()
         # Prepare a pipe to coordinate shutdown of bwrap and the proxy
         bwrap_end, other_end = os.pipe() # both FDs are "non-inheritable" now
         # Invoke the debus-proxy
-        filename = BUBBLEBOX_DIR + "/bus-" + randname()
         args = ["/usr/bin/xdg-dbus-proxy", "--fd="+str(other_end)]
-        args += [os.environ["DBUS_SESSION_BUS_ADDRESS"], filename, "--filter"] + bwrap.dbus_proxy_flags
+        args += ["unix:path="+system_bus, system_bus_proxy, "--filter"] # just block everything for the system bus
+        args += [os.environ["DBUS_SESSION_BUS_ADDRESS"], session_bus_proxy, "--filter"] + bwrap.dbus_proxy_flags
         #pprint(args)
         subprocess.Popen(
             args,
@@ -66,12 +73,17 @@ class DbusProxyDirective:
         )
         # Wait until the proxy is ready
         os.read(bwrap_end, 1)
-        assert os.path.exists(filename)
+        assert os.path.exists(session_bus_proxy)
         # Make sure bwrap can access the other end of the pipe
         os.set_inheritable(bwrap_end, True)
         # Put this at the usual location for the bus insode the sandbox.
         # TODO: What if DBUS_SESSION_BUS_ADDRESS says something else?
-        bwrap.flags.extend(("--bind", filename, XDG_RUNTIME_DIR + "/bus", "--sync-fd", str(bwrap_end)))
+        bwrap.flags.extend((
+            "--setenv", "DBUS_SESSION_BUS_ADDRESS", "unix:path="+session_bus,
+            "--bind", session_bus_proxy, session_bus,
+            "--bind", system_bus_proxy, system_bus,
+            "--sync-fd", str(bwrap_end),
+        ))
 
 # Constructors that should be used instead of directly mentioning the class above.
 def bwrap_flags(*flags):
@@ -110,6 +122,13 @@ class Access:
     Write = 1
     Device = 2
 
+    def WriteTo(host_path):
+        '''Bind-mount a particular host path here (writable)'''
+        access = Access()
+        access.flag = "--bind"
+        access.host_path = host_path
+        return access
+
     def flag(val):
         if val == Access.Read:
             return "--ro-bind"
@@ -119,6 +138,7 @@ class Access:
             return "--dev-bind"
         else:
             raise Exception(f"invalid access value: {val}")
+
 def host_access(dirs):
     def expand(root, names):
         """`names` is one or more strings that can contain globs. Expand them all relative to `root`."""
@@ -132,7 +152,10 @@ def host_access(dirs):
             path = path.replace("//", "/")
             path = path.removesuffix("/.")
             # glob expansion
-            yield from glob.glob(path)
+            globbed = glob.glob(path)
+            if len(globbed) == 0:
+                raise Exception(f"Path does not exist: {path}")
+            yield from globbed
     def recursive_host_access(root, dirs, out):
         for names, desc in dirs.items():
             for path in expand(root, names):
@@ -140,8 +163,11 @@ def host_access(dirs):
                     # Recurse into children
                     recursive_host_access(path, desc, out)
                 else:
+                    assert isinstance(desc, Access) or isinstance(desc, int), f"unexpected access object: {desc}"
                     # Allow access to this path
-                    out.extend((Access.flag(desc), path, path))
+                    host_path = desc.host_path if isinstance(desc, Access) else path
+                    flag = desc.flag if isinstance(desc, Access) else Access.flag(desc)
+                    out.extend((flag, path, host_path))
     # Start the recursive traversal
     out = []
     recursive_host_access("", dirs, out)
@@ -150,5 +176,8 @@ def host_access(dirs):
 def home_access(dirs):
     return host_access({ HOME: dirs })
 
+def home_symlink(dest, link):
+    return bwrap_flags("--symlink", HOME + dest, HOME + link)
+
 # Profile the profiles when importing bubblebox.
 import profiles