diff --git a/pressure-vessel-wrap b/pressure-vessel-wrap index 80990cd82b23ef53af11b2a1ed6545fac5614795..41e97b89290d58ecbd44fdf36262a80b5592ee4d 100755 --- a/pressure-vessel-wrap +++ b/pressure-vessel-wrap @@ -69,6 +69,7 @@ host_fallback= ld_preload=() interactive= runtime= +share_home= tmpdir= verbose= xterm= @@ -102,6 +103,7 @@ usage () { echo " ID is com.example.MyApp or similar." echo " This interoperates with Flatpak." echo "--home=HOME Use HOME as home directory." + echo "--share-home Use the real home directory." echo echo "--host-fallback Run COMMAND on the host system if we" echo " cannot run it in a container." @@ -133,6 +135,7 @@ getopt_temp="${getopt_temp},host-fallback" getopt_temp="${getopt_temp},host-ld-preload:" getopt_temp="${getopt_temp},interactive" getopt_temp="${getopt_temp},runtime:" +getopt_temp="${getopt_temp},share-home" getopt_temp="${getopt_temp},steam-app-id:" getopt_temp="${getopt_temp},verbose" getopt_temp="${getopt_temp},xterm" @@ -191,6 +194,11 @@ while [ "$#" -gt 0 ]; do shift 2 ;; + (--share-home) + share_home=yes + shift 2 + ;; + (--verbose) verbose=yes shift @@ -228,7 +236,7 @@ if [ "$#" -eq 0 ]; then exit 2 fi -if [ -z "$fake_home" ]; then +if [ -z "$share_home" ] && [ -z "$fake_home" ]; then if [ -n "${SteamAppId:-}" ]; then fake_home="$HOME/.var/app/com.steampowered.App$SteamAppId" else @@ -619,47 +627,51 @@ if [ -d /home ]; then bwrap_options+=(--tmpfs /home) fi -# The shellcheck tool warns that -m is only applied to the deepest -# directory and not any parents created via -p, but that's fine here: -# we use a separate mkdir -p for each directory whose permissions we -# care about. -# shellcheck disable=SC2174 -{ - # Set up the home directory - mkdir -m700 -p "$fake_home" - bwrap_options+=(--bind "$fake_home" "$HOME") - bwrap_options+=(--bind "$fake_home" "$fake_home") - - # Set up /var/tmp, XDG_*_HOME like Flatpak does - mkdir -m700 -p "$fake_home/cache" - mkdir -m700 -p "$fake_home/cache/tmp" - bwrap_options+=(--bind "$fake_home/cache/tmp" /var/tmp) - bwrap_options+=(--setenv XDG_CACHE_HOME "$fake_home/cache") - mkdir -m700 -p "$fake_home/config" - bwrap_options+=(--setenv XDG_CONFIG_HOME "$fake_home/config") - mkdir -m700 -p "$fake_home/data" - bwrap_options+=(--setenv XDG_DATA_HOME "$fake_home/data") -} +if [ -n "$share_home" ]; then + bwrap_options+=(--bind "$HOME" "$HOME") +else + # The shellcheck tool warns that -m is only applied to the deepest + # directory and not any parents created via -p, but that's fine here: + # we use a separate mkdir -p for each directory whose permissions we + # care about. + # shellcheck disable=SC2174 + { + # Set up the home directory + mkdir -m700 -p "$fake_home" + bwrap_options+=(--bind "$fake_home" "$HOME") + bwrap_options+=(--bind "$fake_home" "$fake_home") + + # Set up /var/tmp, XDG_*_HOME like Flatpak does + mkdir -m700 -p "$fake_home/cache" + mkdir -m700 -p "$fake_home/cache/tmp" + bwrap_options+=(--bind "$fake_home/cache/tmp" /var/tmp) + bwrap_options+=(--setenv XDG_CACHE_HOME "$fake_home/cache") + mkdir -m700 -p "$fake_home/config" + bwrap_options+=(--setenv XDG_CONFIG_HOME "$fake_home/config") + mkdir -m700 -p "$fake_home/data" + bwrap_options+=(--setenv XDG_DATA_HOME "$fake_home/data") + } -# These might be API entry points, according to .steam/steam/steam.sh. -# On the host system they're symlinks to a real location, but in a -# container it's easier to bind-mount them (this follows symlinks). -# TODO: We probably want to hide part or all of root, steam, steambeta? -for api in bin bin32 bin64 root sdk32 sdk64 steam steambeta; do - dir="$HOME/.steam/$api" - if [ -d "$dir" ]; then - bwrap_options+=(--ro-bind "$dir" "$dir") - fi -done + # These might be API entry points, according to .steam/steam/steam.sh. + # On the host system they're symlinks to a real location, but in a + # container it's easier to bind-mount them (this follows symlinks). + # TODO: We probably want to hide part or all of root, steam, steambeta? + for api in bin bin32 bin64 root sdk32 sdk64 steam steambeta; do + dir="$HOME/.steam/$api" + if [ -d "$dir" ]; then + bwrap_options+=(--ro-bind "$dir" "$dir") + fi + done -# steamclient.so relies on this for communication with Steam -if [ -e "$HOME/.steam/steam.pid" ]; then - bwrap_options+=(--ro-bind "$HOME/.steam/steam.pid" "$HOME/.steam/steam.pid") -fi + # steamclient.so relies on this for communication with Steam + if [ -e "$HOME/.steam/steam.pid" ]; then + bwrap_options+=(--ro-bind "$HOME/.steam/steam.pid" "$HOME/.steam/steam.pid") + fi -# Make sure Steam IPC is available (TODO: do we need this? do we need more?) -if [ -e "$HOME/.steam/steam.pipe" ]; then - bwrap_options+=(--bind "$HOME/.steam/steam.pipe" "$HOME/.steam/steam.pipe") + # Make sure Steam IPC is available (TODO: do we need this? do we need more?) + if [ -e "$HOME/.steam/steam.pipe" ]; then + bwrap_options+=(--bind "$HOME/.steam/steam.pipe" "$HOME/.steam/steam.pipe") + fi fi # We need the LD_PRELOADs from Steam visible at the paths that were