bwrap waterfox

#!/bin/bash
set -euo pipefail

# ============================================================
# WATERFOX SANDBOX - DEVUAN XFCE
# KeePassXC: MANUAL START ONLY
# ============================================================

PROFILE="$HOME/.waterfox"
CACHE="$HOME/.cache/waterfox"
DOWNLOADS="$HOME/Downloads"
XAUTH="${XAUTHORITY:-$HOME/.Xauthority}"

USER_ID="$(id -u)"
GROUP_ID="$(id -g)"
RUNTIME="/run/user/$USER_ID"

FILTERED_BUS="$RUNTIME/waterfox-filtered-bus"

KPXC_SOCK="$RUNTIME/app/org.keepassxc.KeePassXC/org.keepassxc.KeePassXC.BrowserServer"
PULSE_SOCKET="$RUNTIME/pulse/native"

# ============================================================
# PREPARE DIRECTORIES
# ============================================================

mkdir -p "$PROFILE"
mkdir -p "$CACHE"
mkdir -p "$DOWNLOADS"
mkdir -p "$HOME/.cache/fontconfig"

# ============================================================
# CHECK BASIC REQUIREMENTS
# ============================================================

if ! command -v bwrap >/dev/null 2>&1; then
    echo "ERROR: bwrap tidak ditemukan."
    exit 1
fi

if ! command -v xdg-dbus-proxy >/dev/null 2>&1; then
    echo "ERROR: xdg-dbus-proxy tidak ditemukan."
    exit 1
fi

if ! command -v waterfox >/dev/null 2>&1; then
    echo "ERROR: waterfox tidak ditemukan."
    exit 1
fi

# ============================================================
# KEEPASSXC
# MANUAL START ONLY
# ============================================================

if pgrep -x keepassxc >/dev/null 2>&1; then

    echo "[OK] KeePassXC sedang berjalan."

    if [ -S "$KPXC_SOCK" ]; then
        echo "[OK] KeePassXC Browser socket tersedia."
    else
        echo "[INFO] KeePassXC berjalan."
        echo "[INFO] Browser socket belum tersedia."
        echo "[INFO] Pastikan Browser Integration aktif jika diperlukan."
    fi

else

    echo "[INFO] KeePassXC tidak sedang berjalan."
    echo "[INFO] KeePassXC harus dijalankan secara manual jika diperlukan."

fi

# ============================================================
# MACHINE ID
# ============================================================

MACHINE_ID=""

if [ -s /etc/machine-id ]; then
    MACHINE_ID="/etc/machine-id"
elif [ -s /var/lib/dbus/machine-id ]; then
    MACHINE_ID="/var/lib/dbus/machine-id"
fi

if [ -n "$MACHINE_ID" ]; then
    echo "[OK] Machine ID ditemukan: $MACHINE_ID"
else
    echo "[INFO] Machine ID tidak ditemukan."
fi

# ============================================================
# CLEAN OLD D-BUS PROXY
# ============================================================

rm -f "$FILTERED_BUS"

# ============================================================
# D-BUS SESSION ADDRESS
# ============================================================

DBUS_ADDRESS="${DBUS_SESSION_BUS_ADDRESS:-unix:path=$RUNTIME/bus}"

# ============================================================
# START FILTERED D-BUS PROXY
# ============================================================

xdg-dbus-proxy \
    "$DBUS_ADDRESS" \
    "$FILTERED_BUS" \
    --filter \
    --see=org.freedesktop.DBus \
    --talk=org.freedesktop.DBus \
    --see=org.freedesktop.Notifications \
    --talk=org.freedesktop.Notifications &

PROXY_PID=$!

# ============================================================
# CLEANUP
# ============================================================

cleanup() {
    if kill -0 "$PROXY_PID" 2>/dev/null; then
        kill "$PROXY_PID" 2>/dev/null || true
    fi

    rm -f "$FILTERED_BUS"
}

trap cleanup EXIT INT TERM

# ============================================================
# WAIT FOR D-BUS PROXY
# ============================================================

for i in $(seq 1 30); do

    if [ -S "$FILTERED_BUS" ]; then
        break
    fi

    sleep 0.1

done

if [ ! -S "$FILTERED_BUS" ]; then

    echo
    echo "ERROR: Failed to create filtered D-Bus socket."
    echo

    exit 1

fi

echo "[OK] Filtered D-Bus ready."

# ============================================================
# BUILD BWRAP COMMAND
# ============================================================

BWRAP_ARGS=(

    # --------------------------------------------------------
    # PROCESS / PRIVILEGE
    # --------------------------------------------------------

    --die-with-parent
    --new-session

    --cap-drop ALL

    --unshare-user-try
    --unshare-pid
    --unshare-uts
    --unshare-cgroup-try
    --unshare-ipc

    # --------------------------------------------------------
    # SYSTEM
    # --------------------------------------------------------

    --ro-bind /usr /usr
    --ro-bind /bin /bin
    --ro-bind /sbin /sbin
    --ro-bind /lib /lib

    --ro-bind-try /lib64 /lib64
    --ro-bind-try /opt /opt

    # --------------------------------------------------------
    # /etc
    # --------------------------------------------------------

    --dir /etc

    --ro-bind /etc/resolv.conf /etc/resolv.conf

    --ro-bind-try /etc/hosts /etc/hosts
    --ro-bind-try /etc/nsswitch.conf /etc/nsswitch.conf

    --ro-bind-try /etc/ssl /etc/ssl
    --ro-bind-try /etc/ca-certificates /etc/ca-certificates
    --ro-bind-try /etc/pki /etc/pki

    --ro-bind-try /etc/fonts /etc/fonts
    --ro-bind-try /etc/fontconfig /etc/fontconfig

    --ro-bind-try /etc/asound.conf /etc/asound.conf
    --ro-bind-try /etc/localtime /etc/localtime

    --ro-bind-try /etc/xdg /etc/xdg

    --ro-bind-try /etc/passwd /etc/passwd
    --ro-bind-try /etc/group /etc/group

    # --------------------------------------------------------
    # PROC
    # --------------------------------------------------------

    --proc /proc

    # --------------------------------------------------------
    # DEVICES
    # --------------------------------------------------------

    --dev /dev

    --dev-bind-try /dev/dri /dev/dri

    # --------------------------------------------------------
    # SHARED MEMORY
    # --------------------------------------------------------

    --tmpfs /dev/shm

    # --------------------------------------------------------
    # SYS
    # --------------------------------------------------------

    --ro-bind-try /sys/dev/char /sys/dev/char
    --ro-bind-try /sys/devices /sys/devices

    # --------------------------------------------------------
    # TEMP
    # --------------------------------------------------------

    --tmpfs /tmp

    # --------------------------------------------------------
    # /run
    # --------------------------------------------------------

    --tmpfs /run

    --dir /run/user
    --dir /run/user/$USER_ID

    --chmod 0700 /run/user/$USER_ID

    # --------------------------------------------------------
    # APP RUNTIME DIRECTORIES
    # --------------------------------------------------------

    --dir /run/user/$USER_ID/app

    --dir /run/user/$USER_ID/app/org.keepassxc.KeePassXC

    --dir /run/user/$USER_ID/pulse

    # --------------------------------------------------------
    # FILTERED D-BUS
    # --------------------------------------------------------

    --bind "$FILTERED_BUS" "$RUNTIME/bus"

    # --------------------------------------------------------
    # PULSEAUDIO
    # --------------------------------------------------------

    --bind-try "$PULSE_SOCKET" "$PULSE_SOCKET"

    # --------------------------------------------------------
    # KEEPASSXC BROWSER SOCKET
    #
    # HANYA socket ini yang diberikan kepada Waterfox.
    # KeePassXC sendiri TIDAK dijalankan oleh sandbox.
    # --------------------------------------------------------

    --bind-try "$KPXC_SOCK" "$KPXC_SOCK"

    # --------------------------------------------------------
    # /var
    # --------------------------------------------------------

    --tmpfs /var

    --dir /var/tmp
    --dir /var/lib
    --dir /var/lib/dbus
)

# ============================================================
# MACHINE ID
# ============================================================

if [ -n "$MACHINE_ID" ]; then

    BWRAP_ARGS+=(
        --ro-bind "$MACHINE_ID" /var/lib/dbus/machine-id
    )

fi

# ============================================================
# HOME
# ============================================================

BWRAP_ARGS+=(

    --dir /home

    --dir /home/devuan

    # --------------------------------------------------------
    # WATERFOX PROFILE
    # --------------------------------------------------------

    --bind "$PROFILE" /home/devuan/.waterfox

    # --------------------------------------------------------
    # WATERFOX CACHE
    # --------------------------------------------------------

    --bind "$CACHE" /home/devuan/.cache/waterfox

    # --------------------------------------------------------
    # DOWNLOADS
    # --------------------------------------------------------

    --bind "$DOWNLOADS" /home/devuan/Downloads

    # --------------------------------------------------------
    # FONT CACHE
    # --------------------------------------------------------

    --bind "$HOME/.cache/fontconfig" /home/devuan/.cache/fontconfig

    # --------------------------------------------------------
    # X11 AUTH
    # --------------------------------------------------------

    --ro-bind-try "$XAUTH" /home/devuan/.Xauthority

    # ========================================================
    # ENVIRONMENT
    # ========================================================

    --setenv HOME /home/devuan

    --setenv USER devuan

    --setenv LOGNAME devuan

    --setenv DISPLAY "$DISPLAY"

    --setenv XAUTHORITY /home/devuan/.Xauthority

    --setenv XDG_RUNTIME_DIR "$RUNTIME"

    --setenv DBUS_SESSION_BUS_ADDRESS "unix:path=$RUNTIME/bus"

    --setenv NO_AT_BRIDGE 1

    # --------------------------------------------------------
    # X11 ONLY
    # --------------------------------------------------------

    --setenv MOZ_ENABLE_WAYLAND 0

    --setenv GDK_BACKEND x11

    # --------------------------------------------------------
    # GTK
    # --------------------------------------------------------

    --setenv GSETTINGS_BACKEND memory

    # --------------------------------------------------------
    # AUDIO
    # --------------------------------------------------------

    --setenv PULSE_SERVER "unix:$RUNTIME/pulse/native"
)

# ============================================================
# START WATERFOX
# ============================================================

echo
echo "[+] Starting Waterfox..."
echo

exec bwrap \
    "${BWRAP_ARGS[@]}" \
    waterfox "$@"