# Example config for nsjail

name: "chromium-with-net-wayland"

description: "This policy allows to run chromium inside a jail. Access to networking is "
description: "permitted with this setup (via pasta)."
description: ""
description: "The only permitted home directory is $HOME/.mozilla and $HOME/Documents."
description: "The rest of available on the FS files/dires are libs and X-related files/dirs."
description: ""
description: "Run as:"
description: ""
description: "./nsjail --config configs/chromium-with-net-wayland.cfg"
description: ""
description: "You can then go to https://uploadfiles.io/ and try to upload a file in order"
description: "to see how your local directory (also, all system directories) look like."

mode: ONCE
hostname: "CHROMIUM"
cwd: "/user"

time_limit: 0

clone_newnet: true
user_net { }

envar: "HOME=/user"
envar: "DISPLAY"
envar: "TMP=/tmp"
envar: "FONTCONFIG_FILE=/etc/fonts/fonts.conf"
envar: "FC_CONFIG_FILE=/etc/fonts/fonts.conf"
envar: "XDG_RUNTIME_DIR=/run/user/1000"
envar: "WAYLAND_DISPLAY"

rlimit_as: 8388608
rlimit_cpu: 1000
rlimit_fsize: 4096
rlimit_nofile: 1024

uidmap {
	inside_id: "1000"
}

gidmap {
	inside_id: "1000"
}

mount {
	dst: "/proc"
	fstype: "proc"
	rw: true
}

mount {
	src: "/lib"
	dst: "/lib"
	is_bind: true
}

mount {
	src: "/usr/lib"
	dst: "/usr/lib"
	is_bind: true
}

mount {
	src: "/lib64"
	dst: "/lib64"
	is_bind: true
	mandatory: false
}

mount {
	src: "/lib32"
	dst: "/lib32"
	is_bind: true
	mandatory: false
}

mount {
	src: "/usr/share"
	dst: "/usr/share"
	is_bind: true
}

mount {
	src_content: "<?xml version=\"1.0\"?>\n<!DOCTYPE fontconfig SYSTEM \"fonts.dtd\">\n<fontconfig><dir>/usr/share/fonts</dir><cachedir>/tmp/fontconfig</cachedir></fontconfig>"
	dst: "/etc/fonts/fonts.conf"
}

mount {
	src: "/etc/ssl"
	dst: "/etc/ssl"
	is_bind: true
	mandatory: false
}

mount {
	src: "/dev/urandom"
	dst: "/dev/urandom"
	is_bind: true
	rw: true
}

mount {
	src: "/dev/null"
	dst: "/dev/null"
	is_bind: true
	rw: true
}

mount {
	src_content: "nameserver 8.8.8.8\n"
	dst: "/etc/resolv.conf"
}

mount {
	dst: "/tmp"
	fstype: "tmpfs"
	rw: true
	is_bind: false
}

mount {
	dst: "/dev/shm"
	fstype: "tmpfs"
	rw: true
	is_bind: false
}

mount {
	dst: "/user"
	fstype: "tmpfs"
	rw: true
}

mount {
	prefix_src_env: "HOME"
	src: "/Documents"
	dst: "/user/Documents"
	rw: true
	is_bind: true
	mandatory: false
}

# Uncomment, if you want your config to be loaded
# mount {
#	prefix_src_env: "HOME"
#	src: "/.config/chromium"
#	dst: "/user/.config/.chromium"
#	is_bind: true
#	rw: true
#	mandatory: false
#}

mount {
	# Change it to your user id
	src: "/run/user/1000/wayland-0"
	dst: "/run/user/1000/wayland-0"
	is_bind: true
	rw: false
	mandatory: true
}

mount {
	# Change it to your user id
	src: "/run/user/1000/pulse/native"
	dst: "/run/user/1000/pulse/native"
	is_bind: true
	rw: false
	mandatory: false
}

seccomp_string: "KILL_PROCESS {"
seccomp_string: "	ptrace,"
seccomp_string: "	process_vm_readv,"
seccomp_string: "	process_vm_writev"
seccomp_string: "}"
seccomp_string: "ERRNO(38) {"
seccomp_string: "	io_uring_setup,"
seccomp_string: "	io_uring_enter,"
seccomp_string: "	io_uring_register"
seccomp_string: "}"
seccomp_string: "DEFAULT ALLOW"

exec_bin {
	path: "/usr/lib/chromium/chromium"
	arg: "--ozone-platform=wayland"
	arg: "--incognito"
}