diff --git a/README.md b/README.md index 3ed6a3545ea778e69eec23ae99a1a4f17a69eedb..66f9035b0f5118bc91e06558d3d86a0347472a27 100644 --- a/README.md +++ b/README.md @@ -192,19 +192,22 @@ Instructions for testing are available in `/overrides` inside that filesystem, while selected files from the host are visible in `/run/host`. -* If you don't want to protect `$HOME`, add the `--share-home` option. +* To protect `$HOME`, add one of the following options before `--`: + + - `--fake-home=/some/path` (automatically unshares the home directory) + - `--freedesktop-app-id=com.example.Anything --unshare-home` + - `--steam-app-id=70 --unshare-home` (when running from Steam you can use `--steam-app-id=${SteamAppId}`) * To test something manually: - cd to the directory that you want to be the current working directory inside the container - - Run one of: + - Run: + + /opt/pressure-vessel/bin/pressure-vessel-wrap -- ./whatever-game - /opt/pressure-vessel/bin/pressure-vessel-wrap --fake-home=/some/path -- ./whatever-game - /opt/pressure-vessel/bin/pressure-vessel-wrap --freedesktop-app-id=com.example.Anything -- ./whatever-game - /opt/pressure-vessel/bin/pressure-vessel-wrap --steam-app-id=70 -- ./whatever-game - /opt/pressure-vessel/bin/pressure-vessel-wrap --share-home -- ./whatever-game + Optionally add more options before the `--`. * For interactive testing, if your runtime (if used) or host system (if no runtime) contains an xterm binary, you can use something like: diff --git a/pressure-vessel-wrap b/pressure-vessel-wrap index 8df8864b4b2db59eca269e02cbcb3c8d55591290..ec3720f40e4b67ae9533e4e278bb34161d580fb9 100755 --- a/pressure-vessel-wrap +++ b/pressure-vessel-wrap @@ -69,11 +69,13 @@ declare -a env_if_host original_argv=("$@") env_if_host=() fake_home= +freedesktop_app_id= host_fallback= ld_preload=() interactive= runtime= -share_home= +share_home=yes +steam_app_id="${SteamAppId-}" tmpdir= verbose= xterm= @@ -101,14 +103,20 @@ usage () { echo echo "Options:" echo "--share-home Use the real home directory. [Default]" - echo "--steam-app-id=123 Use ~/.var/app/com.steampowered.App123" - echo " as home directory." - echo " [Hint: try --steam-app-id=\$SteamAppId]" - echo "--freedesktop-app-id=ID Use ~/.var/app/ID as home directory." + echo "--unshare-home Use a fake home directory, chosen" + echo " automatically according to" + echo " --freedesktop-app-id," + echo " --steam-app-id, \$SteamAppId." + echo "--home=HOME Use HOME as home directory. Implies" + echo " --unshare-home." + echo + echo "--env-if-host=VAR=VAL Set VAR=VAL if COMMAND is run with" + echo " /usr from the host system, but not if" + echo " it is run with /usr from RUNTIME." + echo "--freedesktop-app-id=ID Make --unshare-home default to" + echo " ~/.var/app/ID as home directory." echo " ID is com.example.MyApp or similar." echo " This interoperates with Flatpak." - echo "--home=HOME Use HOME as home directory." - echo echo "--host-fallback Run COMMAND on the host system if we" echo " cannot run it in a container." echo "--interactive Run an interactive shell instead of" @@ -120,9 +128,10 @@ usage () { echo " merged /usr in the container," echo " and augment it with the host" echo " system's graphics stack." - echo "--env-if-host=VAR=VAL Set VAR=VAL if COMMAND is run with" - echo " /usr from the host system, but not if" - echo " it is run with /usr from RUNTIME." + echo "--steam-app-id=123 Make --unshare-home use" + echo " ~/.var/app/com.steampowered.App123" + echo " as home directory." + echo " [Default: \$SteamAppId]" echo "--verbose Be more verbose." echo "--xterm Same as --interactive, but run an" echo " xterm in the container." @@ -141,6 +150,7 @@ getopt_temp="${getopt_temp},interactive" getopt_temp="${getopt_temp},runtime:" getopt_temp="${getopt_temp},share-home" getopt_temp="${getopt_temp},steam-app-id:" +getopt_temp="${getopt_temp},unshare-home" getopt_temp="${getopt_temp},verbose" getopt_temp="${getopt_temp},xterm" @@ -164,17 +174,18 @@ while [ "$#" -gt 0 ]; do ;; (--freedesktop-app-id) - fake_home="$HOME/.var/app/$2" + freedesktop_app_id="$2" shift 2 ;; (--steam-app-id) - fake_home="$HOME/.var/app/com.steampowered.App$2" + steam_app_id="$2" shift 2 ;; (--home) fake_home="$2" + share_home= shift 2 ;; @@ -203,6 +214,11 @@ while [ "$#" -gt 0 ]; do shift ;; + (--unshare-home) + share_home= + shift + ;; + (--verbose) verbose=yes shift @@ -240,10 +256,6 @@ if [ "$#" -eq 0 ]; then exit 2 fi -if [ -z "$share_home" ] && [ -z "$fake_home" ]; then - share_home=yes -fi - if [ -n "$verbose" ]; then echo "Original argv:" >&2 # Deliberately not expanding $0 in format string @@ -645,6 +657,18 @@ if [ -n "$share_home" ]; then # from the parent process. bwrap_options+=(--bind "$HOME" "$HOME") else + if [ -n "$fake_home" ]; then + : # OK + elif [ -n "$freedesktop_app_id" ]; then + fake_home="$HOME/.var/app/$freedesktop_app_id" + elif [ -n "$steam_app_id" ]; then + fake_home="$HOME/.var/app/com.steampowered.App$steam_app_id" + else + echo "$me: Error: --unshare-home requires --fake-home," >&2 + echo "$me: --freedesktop-app-id, --steam-app-id or \$SteamAppId" >&2 + exit 2 + fi + # The shellcheck tool warns that -m is only applied to the deepest # directory and not any parents created via -p, but that's fine here: # we use a separate mkdir -p for each directory whose permissions we