diff --git a/README.md b/README.md index 57a8aabd..ed99c34f 100644 --- a/README.md +++ b/README.md @@ -21,18 +21,18 @@ An example script, `private-profile.sh`, which makes use of `gen_libraries` is p A `.private` file defines several application-specific variables. The following variables are recognized: -* `$PRIVLIB` enables the dynamic generation of a `private-lib` filter. If enabled, the following variables should be defined: - * `$GENLIB` is the path to the `gen_libraries` path. - * `$LIBDIR` is the path to the application's lib folder. - * `$EXTRALIBS` is the list of hard-coded libraries which are not automatically detected. -* `USE_SYSTEMD` enables `systemd` integration. -* `PROFILEDIR` is the path to the directory where profiles are stored. -* `TOCOPY` is the list of files to copy to the temporary profile. -* `DESTDIR` is the directory to generate inside the temporary profile directory. If set to `""`, then the temporary directory itself is treated as the profile. -* `PROGNAME` is the command to run. -* `PROGARGS` is the array of arguments to pass when the program is not already running. -* `RPROGARGS` is the array of arguments to pass when the program is already running. -* `ENVVARS` is a bash array used for setting any environment variables (now uses `firejail`'s environment handling!). Set this to an empty array (`()`) if you don't have any environment variables to pass along. +* `$privlib` enables the dynamic generation of a `private-lib` filter. If enabled, the following variables should be defined: + * `$genlib` is the path to the `gen_libraries` path. + * `$libdir` is the path to the application's lib folder. + * `$extralibs` is the list of hard-coded libraries which are not automatically detected. +* `$use_systemd` enables `systemd` integration. +* `$profiledir` is the path to the directory where profiles are stored. +* `$tocopy` is the list of files to copy to the temporary profile. +* `$destdir` is the directory to generate inside the temporary profile directory. If set to `""`, then the temporary directory itself is treated as the profile. +* `$progname` is the command to run. +* `$progargs` is the array of arguments to pass when the program is not already running. +* `$rprogargs` is the array of arguments to pass when the program is already running. +* `$envvars` is a bash array used for setting any environment variables (now uses `firejail`'s environment handling!). Set this to an empty array (`()`) if you don't have any environment variables to pass along. There are two example `.private` files in this repo, `private-profiles/firefox.private` and `private-profiles/chromium.private`. diff --git a/private-profile.sh b/private-profile.sh index 903ae2b1..2edad497 100755 --- a/private-profile.sh +++ b/private-profile.sh @@ -1,10 +1,10 @@ #!/bin/bash -PRIVATE=0 -NAME="" -COPY=0 -NETNS="" -RMPROF=0 +private=0 +name="" +copy=0 +netns="" +rmprof=0 set -ue @@ -12,17 +12,17 @@ while getopts "p:tcn:" arg do case ${arg} in p) - PROFILE=${OPTARG} - NAME=$(basename "$PROFILE") + profile=${OPTARG} + name=$(basename "$profile") ;; t) - PRIVATE=1 + private=1 ;; c) - COPY=1 + copy=1 ;; n) - NETNS=${OPTARG} + netns=${OPTARG} ;; *) exit 1 @@ -32,90 +32,90 @@ done shift $((OPTIND-1)) -VARFILE="$1" -. "$VARFILE" +varfile="$1" +. "$varfile" shift vpncmd() { - systemctl -q is-active openvpn@us3-TCP-chaanakya && NETNS="" || NETNS="$NETNS" + systemctl -q is-active openvpn@us3-TCP-chaanakya && netns="" || netns="$netns" } -FIREJAIL="firejail" -FJARGS=( "--nowhitelist=${PROFILEDIR}" ) +firejail="firejail" +fjargs=( "--nowhitelist=${profiledir}" ) # private-lib generation if enabled -if [ "$PRIVLIB" -eq 1 ] +if [ "$privlib" -eq 1 ] then - . "$GENLIB" - LIBS=$(compile_list "${LIBDIR}" "${EXTRALIBS}") - FJARGS+=( "--private-lib=$LIBS" ) + . "$genlib" + libs=$(compile_list "${libdir}" "${extralibs}") + fjargs+=( "--private-lib=$libs" ) fi # Deal with creating a private profile if requested -if [ "$PRIVATE" -eq 1 ] +if [ "$private" -eq 1 ] then - SRCDIR="${PROFILE}" - PROFILE=$(mktemp -d -p "${PROFILEDIR}") - NAME=$(basename "$PROFILE") - if [ "${DESTDIR}" != "" ] + nprofile=$(mktemp -d -p "${profiledir}") + name=$(basename "$nprofile") + if [ "${destdir}" != "" ] then - mkdir "${PROFILE}"/"${DESTDIR}" + mkdir "${nprofile}"/"${destdir}" fi - RMPROF=1 - if [ "$COPY" -eq 1 ] + rmprof=1 + if [ "$copy" -eq 1 ] then - for i in "${TOCOPY[@]}" + for i in "${tocopy[@]}" do - cp -R "${SRCDIR}"/"${i}" "${PROFILE}"/"${DESTDIR}"/"${i}" + cp -R "${profile}"/"${i}" "${nprofile}"/"${destdir}"/"${i}" done fi + profile="$nprofile" fi -SPROGNAME=$(basename "${PROGNAME}") +sprogname=$(basename "${progname}") -FJARGS+=( "--whitelist=${PROFILE}" "--name=${SPROGNAME}-${NAME}" ) +fjargs+=( "--whitelist=${profile}" "--name=${sprogname}-${name}" ) vpncmd -if [ "$NETNS" != "" ] +if [ "$netns" != "" ] then - FJARGS+=( "--net=${NETNS}" ) + fjargs+=( "--net=${netns}" ) fi -for i in "${ENVVARS[@]}" +for i in "${envvars[@]}" do - FJARGS+=( "--env=${i}" ) + fjargs+=( "--env=${i}" ) done -CMD="${FIREJAIL} ${FJARGS[*]} -- ${PROGNAME} $(eval echo "${PROGARGS[@]}")" -RCMD="${PROGNAME} $(eval echo "${RPROGARGS[@]}")" +cmd="${firejail} ${fjargs[*]} -- ${progname} $(eval echo "${progargs[@]}")" +rcmd="${progname} $(eval echo "${rprogargs[@]}")" -SYSTEMDCMD="systemd-run --wait --user --unit=${SPROGNAME}-${NAME}.service --description=${SPROGNAME}-${NAME}" +systemdcmd="systemd-run --wait --user --unit=${sprogname}-${name}.service --description=${sprogname}-${name}" # systemd-specific behavior if enabled -if [ "$USE_SYSTEMD" -eq 1 ] +if [ "$use_systemd" -eq 1 ] then - RUNNING=$(systemctl --user --quiet is-active "${SPROGNAME}-${NAME}".service; echo $?) - CMD="${SYSTEMDCMD} ${CMD}" + running=$(systemctl --user --quiet is-active "${sprogname}-${name}".service; echo $?) + cmd="${systemdcmd} ${cmd}" else - RUNNING=$(pgrep -f "${PROG}" > /dev/null; echo $?) + running=$(pgrep -f "${progname} $(eval echo "${progargs[@]}")" > /dev/null; echo $?) fi -if [ "$RUNNING" -eq 0 ] +if [ "$running" -eq 0 ] then - $RCMD + $rcmd else - $CMD + $cmd fi # Remove profile if asked -if [ "$RMPROF" -eq 1 ] +if [ "$rmprof" -eq 1 ] then - rm -r "${PROFILE}" + rm -r "${profile}" fi diff --git a/private-profiles/chromium.private b/private-profiles/chromium.private index d5b7b9a5..0a4954fe 100644 --- a/private-profiles/chromium.private +++ b/private-profiles/chromium.private @@ -1,9 +1,9 @@ -PRIVLIB=0 -USE_SYSTEMD=1 -PROFILEDIR=~/.config/chromium/ -TOCOPY=( Extensions "Extension State" Preferences ) -DESTDIR="Default" -PROGNAME="/usr/lib/chromium/chromium" -PROGARGS=( '--user-data-dir=${PROFILE}' '$*' ) -RPROGARGS=( '--user-data-dir=${PROFILE}' '$*' ) -ENVVARS=() +privlib=0 +use_systemd=1 +profiledir=~/.config/chromium/ +tocopy=( Extensions "Extension State" Preferences ) +destdir="Default" +progname="/usr/lib/chromium/chromium" +progargs=( '--user-data-dir=${profile}' '$*' ) +rprogargs=( '--user-data-dir=${profile}' '$*' ) +envvars=() diff --git a/private-profiles/firefox.private b/private-profiles/firefox.private index c1ccbef3..0f8ba69e 100644 --- a/private-profiles/firefox.private +++ b/private-profiles/firefox.private @@ -1,12 +1,12 @@ -LIBDIR=/usr/lib/firefox -EXTRALIBS="nss,pulseaudio,nvidia,python3.6,gconv,libpulse.so.0,libFLAC.so.8,libogg.so.0,libopus.so.0,libvorbis.so.0,libvorbisenc.so.2,libavcodec.so.57,libavutil.so.55,libcrystalhd.so.3,libdrm.so.2,libGL.so.1,libnss_resolve.so.2,libnss_systemd.so.2" -GENLIB=~/scripts/gen_libraries -PRIVLIB=1 -USE_SYSTEMD=1 -PROFILEDIR=~/.mozilla/firefox/ -TOCOPY=( extensions browser-extension-data extension-preferences.json extension-settings.json extensions.json prefs.js gmp gmp-widevinecdm gmp-gmpopenh264 search.json.mozlz4 pluginreg.dat ) -DESTDIR="" -PROGNAME="firefox" -PROGARGS=( --new-instance --profile '${PROFILE}' '$*' ) -RPROGARGS=( --profile '${PROFILE}' '$*' ) -ENVVARS=( "MOZ_WEBRENDER=1" "MOZ_ACCELERATED=1" ) +libdir=/usr/lib/firefox +extralibs="nss,pulseaudio,nvidia,python3.6,gconv,libpulse.so.0,libFLAC.so.8,libogg.so.0,libopus.so.0,libvorbis.so.0,libvorbisenc.so.2,libavcodec.so.57,libavutil.so.55,libcrystalhd.so.3,libdrm.so.2,libGL.so.1,libnss_resolve.so.2,libnss_systemd.so.2" +genlib=~/scripts/gen_libraries +privlib=1 +use_systemd=1 +profiledir=~/.mozilla/firefox/ +tocopy=( extensions browser-extension-data extension-preferences.json extension-settings.json extensions.json prefs.js gmp gmp-widevinecdm gmp-gmpopenh264 search.json.mozlz4 pluginreg.dat ) +destdir="" +progname="firefox" +progargs=( --new-instance --profile '${profile}' '$*' ) +rprogargs=( --profile '${profile}' '$*' ) +envvars=( "MOZ_WEBRENDER=1" "MOZ_ACCELERATED=1" )