global.yml

use: [common, private-home]
command: [bash]
rules:
  common:
    - >-
      Apply common restrictions such as limiting access to environment
      variables and the file system while still allowing basic programs to
      operate correctly.

    - args: [--clearenv, --unshare-pid, --die-with-parent]
    # More restrictive options to consider.
    # - args: [--unshare-uts, --unshare-ipc, --unshare-user, --unshare-cgroup]
    - proc: /proc
    - dev: /dev
    - tmpfs: /tmp
    - restrict-tty:
    - env: {PATH: /usr/bin:/bin}
    - env: [LANG, XDG_RUNTIME_DIR, XDG_SESSION_TYPE, TERM, HOME, LOGNAME, USER,
            EDITOR, SANDBOX]
    - bind: /etc
    - symlink: [/usr/lib, /lib]
    - symlink: [/usr/lib64, /lib64]
    - bind: /usr/lib
    - bind: /usr/lib64
    - bind: /usr/libexec
    - bind: /usr/bin
    - bind: /usr/share
    - bind: /usr/include
    - symlink: [usr/bin, /bin]
    - symlink: [usr/bin, /sbin]
    - tmpfs: $XDG_RUNTIME_DIR
    - file: $XDG_RUNTIME_DIR/flatpak-info
    - file: /.flatpak-info
    - bind: {path: /run/systemd/resolve, try: true}

  downloads:
    - Bind the user's Downloads directory.
    - bind: {path: $HOME/Downloads, read-write: true}

  private-home:
    - Creates a private writable home directory.
    - bind:
        path: $SANDBOX_HOME
        dst: $HOME
        read-write: true
        create: skel
    - dir: $HOME/.config
    - dir: $HOME/.cache
    - dir: $HOME/.local/share

  cli:
    - Enables typical Command Line Interface options.
    - use: [common, private-home, cwd]

  gui:
    - Enables typical Graphical User Interface options.
    - use: [common, private-home, x11, wayland, audio, dbus, accessibility]

  cwd:
    - Bind the current directory with write permission.
    - bind: {cwd: true, read-write: true}

  x11:
    - Allow access to an X11 display.
    - ifdef:
      - DISPLAY
      - env: DISPLAY
      - bind: /tmp/.X11-unix/

  wayland:
    - Allow access to Wayland.
    - ifdef:
      - WAYLAND_DISPLAY
      - env: WAYLAND_DISPLAY
      - bind: $XDG_RUNTIME_DIR/$WAYLAND_DISPLAY

  audio:
    - Enables pulseaudio or pipewire.
    - bind: $XDG_RUNTIME_DIR/pulse/native
    - bind: {path: $HOME/.config/pulse/cookie, try: true}
    - bind: {path: $XDG_RUNTIME_DIR/pipewire-0, try: true}

  video:
    - Enables access to video devices.
    - bind: {path: /dev/v4l, dev: true}
    - bind: {path: /dev/video0, dev: true, try: true}
    - bind: {path: /dev/video1, dev: true, try: true}
    - bind: {path: /dev/video2, dev: true, try: true}
    - bind: {path: /dev/video3, dev: true, try: true}

  accessibility:
    - Enables dbus accessibility calls.
    - dbus: {allow: call, path: 'org.a11y.Bus.*=*'}
    - bind: {path: $XDG_RUNTIME_DIR/at-spi, try: true}

  dbus:
    - >-
      Enables limited dbus access through XDG Desktop Portal.
      It allows access to files outside the sandbox but only via the
      systems file selection dialog.  As well as, printing and screen
      sharing services.
    - dbus: {allow: talk, path: org.freedesktop.portal.Documents}
    - dbus: {allow: talk, path: org.freedesktop.portal.Flatpak}
    - dbus: {allow: talk, path: org.freedesktop.portal.Desktop}
    - dbus: {allow: talk, path: org.freedesktop.portal.FileChooser}
    - dbus: {allow: talk, path: org.freedesktop.portal.Print}
    - dbus: {allow: talk, path: org.freedesktop.portal.Camera}
    - dbus: {allow: talk, path: org.freedesktop.portal.Device}
    - dbus:
        allow: broadcast
        path: org.freedesktop.portal.Desktop=org.freedesktop.portal.Settings.SettingChanged@/org/freedesktop/portal/desktop
    - bind:
        path: $XDG_RUNTIME_DIR/doc/by-app/$APP_NAME
        dst: $XDG_RUNTIME_DIR/doc
        read-write: true
        try: true

  gpu:
    - Enables GPU access.
    - use: [nvidia]
    - bind: {path: /dev/dri, dev: true}
    - bind: /sys/dev/char
    - bind: /sys/devices

  nvidia:
    - Enables access to NVidia GPU device.
    - bind: {path: /dev/nvidiactl,        dev: true}
    - bind: {path: /dev/nvidia-uvm,       dev: true}
    - bind: {path: /dev/nvidia-uvm-tools, dev: true}
    - bind: {path: /dev/nvidia-modeset,   dev: true}
    - bind: {path: /dev/nvidia0,          dev: true, try: true}
    - bind: {path: /dev/nvidia1,          dev: true, try: true}

  firefox:
    - A special rule for running the Firefox web browser.
    - ifdef:
      - WAYLAND_DISPLAY
      - env: {MOZ_ENABLE_WAYLAND: 1}
    - dbus: {allow: own, path: org.mozilla.firefox.*}

  gthumb:
    - A special rule for running the GThumb image viewer.
    - dbus: {allow: own, path: org.gnome.gThumb.*}

  transmission:
    - Allow access to Transmission bittorrent client
    - dbus: {allow: call, path: com.transmissionbt.Transmission.*=*}