#!/usr/bin/env bash ## Dependencies: bash gzip fuse2 (or fuse3) tar coreutils LD_PRELOAD_ORIG="${LD_PRELOAD}" LD_LIBRARY_PATH_ORIG="${LD_LIBRARY_PATH}" unset LD_PRELOAD LD_LIBRARY_PATH LC_ALL_ORIG="${LC_ALL}" export LC_ALL=C msg_root=" Do not run this script as root! If you really need to run it as root and know what you are doing, set the ALLOW_ROOT environment variable. " # Refuse to run as root unless environment variable is set if (( EUID == 0 )) && [ -z "$ALLOW_ROOT" ]; then echo "${msg_root}" exit 1 fi # Conty version script_version="1.26.2" # Important variables to manually adjust after modification! # Needed to avoid problems with mounting due to an incorrect offset. # # If you build Conty without some of the components, you can set their # size to 0 init_size=50000 bash_size=1752808 script_size=38502 busybox_size=1181592 utils_size=4392469 # Full path to the script if [ -n "${BASH_SOURCE[0]}" ]; then script_literal="${BASH_SOURCE[0]}" else script_literal="${0}" if [ "${script_literal}" = "$(basename "${script_literal}")" ]; then script_literal="$(command -v "${0}")" fi fi script_name="$(basename "${script_literal}")" script="$(readlink -f "${script_literal}")" # MD5 of the first 4 MB and the last 1 MB of the script script_md5="$(head -c 4000000 "${script}" | md5sum | head -c 7)"_"$(tail -c 1000000 "${script}" | md5sum | head -c 7)" script_id="$$" # Working directory where the utils will be extracted # And where the image will be mounted # The default path is /tmp/conty_username_scriptmd5 # And if /tmp is mounted with noexec, the default path # is ~/.local/share/Conty/conty_username_scriptmd5 conty_dir_name=conty_"${USER}"_"${script_md5}" if [ -z "${BASE_DIR}" ]; then export working_dir=/tmp/"${conty_dir_name}" else export working_dir="${BASE_DIR}"/"${conty_dir_name}" fi if [ "${USE_SYS_UTILS}" != 1 ] && [ "${busybox_size}" -gt 0 ]; then busybox_bin_dir="${working_dir}"/busybox_bins busybox_path="${busybox_bin_dir}"/busybox if [ ! -f "${busybox_bin_dir}"/echo ]; then mkdir -p "${busybox_bin_dir}" tail -c +$((init_size+bash_size+script_size+1)) "${script}" | head -c "${busybox_size}" > "${busybox_path}" chmod +x "${busybox_path}" 2>/dev/null "${busybox_path}" --install -s "${busybox_bin_dir}" &>/dev/null fi if "${busybox_bin_dir}"/echo &>/dev/null; then export PATH="${busybox_bin_dir}:${PATH}" fi fi # Help output msg_help=" Usage: ${script_name} [COMMAND] [ARGUMENTS] Arguments: -e Extract the image -h Display this text -H Display bubblewrap help -g Run the Conty's graphical interface -l Show a list of all installed packages -d Export desktop files from Conty into the application menu of your desktop environment. Note that not all applications have desktop files, and also that desktop files are tied to the current location of Conty, so if you move or rename it, you will need to re-export them. To remove the exported files, use this argument again. -m Mount/unmount the image The image will be mounted if it's not, unmounted otherwise. Mount point can be changed with the BASE_DIR env variable (the default is /tmp). -o Show the image offset -u Update all packages inside the container This requires a rebuild of the image, which may take quite a lot of time, depending on your hardware and internet speed. Additional disk space (about 6x the size of the current file) is needed during the update process. -v Display version of this script -V Display version of the image Arguments that don't match any of the above will be passed directly to bubblewrap, so all bubblewrap arguments are supported as well. Environment variables: BASE_DIR Sets a custom directory where Conty will extract its builtin utilities and mount the image. The default is /tmp. DISABLE_NET Disables network access. DISABLE_X11 Disables access to X server. Note: Even with this variable enabled applications can still access your X server if it doesn't use XAUTHORITY and listens to the abstract socket. This can be solved by enabling XAUTHORITY, disabling the abstract socket or by disabling network access. HOME_DIR Sets the home directory to a custom location. For example: HOME_DIR=\"$HOME/custom_home\" Note: If this variable is set the home directory inside the container will still appear as $HOME, even though the custom directory is used. QUIET_MODE Disables all non-error Conty messages. Doesn't affect the output of applications. SANDBOX Enables a sandbox. To control which files and directories are available inside the container, you can use the --bind and --ro-bind launch arguments. (See bubblewrap help for more info). SANDBOX_LEVEL Controls the strictness of the sandbox. Available levels: 1: Isolates all user files. 2: Additionally disables dbus and hides all running processes. 3: Additionally disables network access and isolates X11 server with Xephyr. The default is 1. USE_OVERLAYFS Mounts a writable unionfs-fuse filesystem on top of the read-only squashfs/dwarfs image, allowing to modify files inside it. Overlays are stored in ~/.local/share/Conty. If you want to undo any changes, delete the entire directory from there. NVIDIA_HANDLER Fixes issues with graphical applications on Nvidia GPUs with the proprietary driver. Enable this only if you are using an Nvidia GPU, the proprietary driver and encountering issues running graphical applications. At least 2 GB of free disk space is required. This function is enabled by default. USE_SYS_UTILS Tells the script to use squashfuse/dwarfs and bwrap installed on the system instead of the builtin ones. XEPHYR_SIZE Sets the size of the Xephyr window. The default is 800x600. CUSTOM_MNT Sets a custom mount point for the Conty. This allows Conty to be used with already mounted filesystems. Conty will not mount its image on this mount point, but it will use files that are already present there. Additional notes: System directories/files will not be available inside the container if you set the SANDBOX variable but don't bind (mount) any items or set HOME_DIR. A fake temporary home directory will be used instead. If the executed script is a symlink with a different name, said name will be used as the command name. For instance, if the script is a symlink with the name \"wine\" it will automatically run wine during launch. Running Conty without any arguments from a graphical interface (for example, from a file manager) will automatically launch the Conty's graphical interface. Besides updating all packages, you can also install and remove packages using the same -u argument. To install packages add them as additional arguments, to remove add a minus sign (-) before their names. To install: ${script_name} -u pkgname1 pkgname2 pkgname3 ... To remove: ${script_name} -u -pkgname1 -pkgname2 -pkgname3 ... In this case Conty will update all packages and additionally install and/or remove specified packages. If you are using an Nvidia GPU, please read the following: https://github.com/Kron4ek/Conty#known-issues " if [ -n "${CUSTOM_MNT}" ] && [ -d "${CUSTOM_MNT}" ]; then mount_point="${CUSTOM_MNT}" else mount_point="${working_dir}"/mnt fi export overlayfs_dir="${HOME}"/.local/share/Conty/overlayfs_"${script_md5}" export nvidia_drivers_dir="${overlayfs_dir}"/nvidia export overlayfs_shared_dir="${HOME}"/.local/share/Conty/overlayfs_shared export nvidia_drivers_shared_dir="${overlayfs_shared_dir}"/nvidia # Offset where the image is stored offset=$((init_size+bash_size+script_size+busybox_size+utils_size)) # Detect if the image is compressed with DwarFS or SquashFS if [ "$(tail -c +$((offset+1)) "${script}" | head -c 6)" = "DWARFS" ]; then dwarfs_image=1 fi # These arguments are used to rebuild the image when using the self-update function squashfs_comp_arguments=(-b 1M -comp zstd -Xcompression-level 19) dwarfs_comp_arguments=(-l7 -C zstd:level=19 --metadata-compression null \ -S 21 -B 1 --order nilsimsa \ -W 12 -w 4 --no-create-timestamp) # Enable NVIDIA_HANDLER by default NVIDIA_HANDLER="${NVIDIA_HANDLER:-1}" unset script_is_symlink if [ -L "${script_literal}" ]; then script_is_symlink=1 fi if [ -z "${script_is_symlink}" ]; then if [ -t 0 ] && ([ "$1" = "-h" ] || [ -z "$1" ]); then echo "${msg_help}" exit elif [ "$1" = "-v" ]; then echo "${script_version}" exit elif [ "$1" = "-o" ]; then echo "${offset}" exit fi fi show_msg () { if [ "${QUIET_MODE}" != 1 ]; then echo "$@" fi } exec_test () { mkdir -p "${working_dir}" exec_test_file="${working_dir}"/exec_test rm -f "${exec_test_file}" touch "${exec_test_file}" chmod +x "${exec_test_file}" [ -x "${exec_test_file}" ] } launch_wrapper () { if [ "${USE_SYS_UTILS}" = 1 ]; then "$@" else "${working_dir}"/utils/ld-linux-x86-64.so.2 --library-path "${working_dir}"/utils "$@" fi } gui () { if ! command -v zenity 1>/dev/null; then exit 1 fi gui_response=$(zenity --title="Conty" \ --entry \ --text="Enter a command or select a file you want to run" \ --ok-label="Run" \ --cancel-label="Quit" \ --extra-button="Select a file" \ --extra-button="Open a terminal") gui_exit_code=$? if [ "${gui_response}" = "Select a file" ]; then filepath="$(zenity --title="A file to run" --file-selection)" if [ -f "${filepath}" ]; then [ -x "${filepath}" ] || chmod +x "${filepath}" "${filepath}" else zenity --error --text="You did not select a file" fi elif [ "${gui_response}" = "Open a terminal" ]; then if command -v lxterminal 1>/dev/null; then lxterminal -T "Conty terminal" --command="bash -c 'echo Welcome to Conty; echo Enter any commands you want to execute; bash'" else zenity --error --text="A terminal emulator is not installed in this instance of Conty" fi elif [ "${gui_exit_code}" = 0 ]; then if [ -z "${gui_response}" ]; then zenity --error --text="You need to enter a command to execute" else for a in ${gui_response}; do if [ "${a:0:1}" = "\"" ] || [ "${a:0:1}" = "'" ] || [ -n "${combined_args}" ]; then combined_args="${combined_args} ${a}" if [ "${a: -1}" = "\"" ] || [ "${a: -1}" = "'" ]; then combined_args="${combined_args:2}" combined_args="${combined_args%?}" launch_command+=("${combined_args}") unset combined_args fi continue fi launch_command+=("${a}") done "${launch_command[@]}" fi fi } mount_overlayfs () { mkdir -p "${overlayfs_dir}"/up mkdir -p "${overlayfs_dir}"/work mkdir -p "${overlayfs_dir}"/merged mkdir -p "${nvidia_drivers_dir}" if [ ! "$(ls "${overlayfs_dir}"/merged 2>/dev/null)" ]; then if command -v "${unionfs_fuse}" 1>/dev/null; then if [ "${1}" = "share_nvidia" ]; then launch_wrapper "${unionfs_fuse}" -o relaxed_permissions,cow,noatime "${overlayfs_dir}"/up=RW:"${overlayfs_shared_dir}"/up=RO:"${mount_point}"=RO "${overlayfs_dir}"/merged else launch_wrapper "${unionfs_fuse}" -o relaxed_permissions,cow,noatime "${overlayfs_dir}"/up=RW:"${mount_point}"=RO "${overlayfs_dir}"/merged fi else echo "unionfs-fuse not found" return 1 fi fi } nvidia_driver_handler () { OLD_PWD="${PWD}" rm -rf "${nvidia_drivers_dir}"/nvidia.run "${nvidia_drivers_dir}"/nvidia-driver mkdir -p "${nvidia_drivers_dir}" cd "${nvidia_drivers_dir}" echo "Found Nvidia driver ${nvidia_driver_version}" echo "Downloading the Nvidia driver ${nvidia_driver_version}..." # Try to download the driver from the default Nvidia URL driver_url="https://us.download.nvidia.com/XFree86/Linux-x86_64/${nvidia_driver_version}/NVIDIA-Linux-x86_64-${nvidia_driver_version}.run" curl -#Lo nvidia.run "${driver_url}" # If the previous download failed, get the URL from FlatHub repo if [ ! -s nvidia.run ] || [ "$(stat -c%s nvidia.run)" -lt 30000000 ]; then rm -f nvidia.run driver_url="https:$(curl -#Lo - "https://raw.githubusercontent.com/flathub/org.freedesktop.Platform.GL.nvidia/master/data/nvidia-${nvidia_driver_version}-x86_64.data" | cut -d ':' -f 6)" curl -#Lo nvidia.run "${driver_url}" fi if [ -s nvidia.run ]; then echo "Installing the Nvidia driver, please wait..." chmod +x nvidia.run ./nvidia.run --target nvidia-driver -x &>/dev/null if [ -f nvidia-driver/nvidia-installer ]; then cd nvidia-driver || exit 1 chmod +x nvidia-installer fakeroot ./nvidia-installer --silent --no-x-check --no-kernel-module &>/dev/null rm -rf "${nvidia_drivers_dir}"/nvidia.run "${nvidia_drivers_dir}"/nvidia-driver if [ -s /usr/lib/libGLX_nvidia.so."${nvidia_driver_version}" ] || \ [ -s /usr/lib/libGL.so."${nvidia_driver_version}" ]; then echo "${nvidia_driver_version}" > "${nvidia_drivers_dir}"/current-nvidia-version echo "The driver installed successfully" else echo "Failed to install the driver" fi else echo "Failed to extract the driver" fi else echo "Failed to download the driver" fi cd "${OLD_PWD}" } update_conty () { if [ "$(ls /var/cache/pacman/pkg_host 2>/dev/null)" ]; then mkdir -p /var/cache/pacman/pkg ln -s /var/cache/pacman/pkg_host/* /var/cache/pacman/pkg 2>/dev/null fi reflector --protocol https --score 5 --sort rate --save /etc/pacman.d/mirrorlist fakeroot -- pacman -Syy 2>/dev/null date -u +"%d-%m-%Y %H:%M (DMY UTC)" > /version fakeroot -- pacman --noconfirm -S archlinux-keyring 2>/dev/null fakeroot -- pacman --noconfirm -S chaotic-keyring 2>/dev/null rm -rf /etc/pacman.d/gnupg/* fakeroot -- pacman-key --init echo "keyserver hkps://keyserver.ubuntu.com" >> /etc/pacman.d/gnupg/gpg.conf fakeroot -- pacman-key --populate archlinux fakeroot -- pacman-key --populate chaotic fakeroot -- pacman --noconfirm --overwrite "*" --ignore fakeroot -Su 2>/dev/null fakeroot -- pacman --noconfirm -Runs ${pkgsremove} 2>/dev/null fakeroot -- pacman --noconfirm -S ${pkgsinstall} 2>/dev/null ldconfig -C /etc/ld.so.cache rm -f /var/cache/pacman/pkg/* pacman -Q > /pkglist.x86_64.txt update-ca-trust locale-gen } # Check if FUSE is installed if ! command -v fusermount3 1>/dev/null && ! command -v fusermount 1>/dev/null; then echo "Please install fuse2 or fuse3 and run the script again." exit 1 fi if command -v fusermount3 1>/dev/null; then fuse_version=3 fi # Set the dwarfs block cache size depending on how much RAM is available # Also set the number of workers depending on the number of CPU cores dwarfs_cache_size="128M" dwarfs_num_workers="2" if [ "${dwarfs_image}" = 1 ]; then if getconf _PHYS_PAGES &>/dev/null && getconf PAGE_SIZE &>/dev/null; then memory_size="$(($(getconf _PHYS_PAGES) * $(getconf PAGE_SIZE) / (1024 * 1024)))" if [ "${memory_size}" -ge 45000 ]; then dwarfs_cache_size="4096M" elif [ "${memory_size}" -ge 23000 ]; then dwarfs_cache_size="2048M" elif [ "${memory_size}" -ge 15000 ]; then dwarfs_cache_size="1024M" elif [ "${memory_size}" -ge 7000 ]; then dwarfs_cache_size="512M" elif [ "${memory_size}" -ge 3000 ]; then dwarfs_cache_size="256M" elif [ "${memory_size}" -ge 1500 ]; then dwarfs_cache_size="128M" else dwarfs_cache_size="64M" fi fi if getconf _NPROCESSORS_ONLN &>/dev/null; then dwarfs_num_workers="$(getconf _NPROCESSORS_ONLN)" if [ "${dwarfs_num_workers}" -ge 8 ]; then dwarfs_num_workers=8 fi fi fi # Extract utils.tar.gz mkdir -p "${working_dir}" if ([ "${USE_SYS_UTILS}" != 1 ] && [ "${utils_size}" -gt 0 ]) || [ "$1" = "-u" ]; then # Check if filesystem of the working_dir is mounted without noexec if ! exec_test; then if [ -z "${BASE_DIR}" ]; then export working_dir="${HOME}"/.local/share/Conty/"${conty_dir_name}" if [ -z "${CUSTOM_MNT}" ]; then mount_point="${working_dir}"/mnt fi fi if ! exec_test; then echo "Seems like /tmp is mounted with noexec or you don't have write access!" echo "Please remount it without noexec or set BASE_DIR to a different location." exit 1 fi fi if ! command -v tar 1>/dev/null || ! command -v gzip 1>/dev/null; then echo "Please install tar and gzip and run the script again." exit 1 fi if [ "${dwarfs_image}" = 1 ]; then mount_tool="${working_dir}"/utils/dwarfs"${fuse_version}" extraction_tool="${working_dir}"/utils/dwarfsextract compression_tool="${working_dir}"/utils/mkdwarfs else mount_tool="${working_dir}"/utils/squashfuse"${fuse_version}" extraction_tool="${working_dir}"/utils/unsquashfs compression_tool="${working_dir}"/utils/mksquashfs fi bwrap="${working_dir}"/utils/bwrap unionfs_fuse="${working_dir}"/utils/unionfs"${fuse_version}" if [ ! -f "${mount_tool}" ] || [ ! -f "${bwrap}" ]; then tail -c +$((init_size+bash_size+script_size+busybox_size+1)) "${script}" | head -c "${utils_size}" | tar -C "${working_dir}" -zxf - if [ ! -f "${mount_tool}" ] || [ ! -f "${bwrap}" ]; then clear echo "The integrated utils were not extracted!" echo "Perhaps something is wrong with the integrated utils.tar.gz." exit 1 fi chmod +x "${mount_tool}" 2>/dev/null chmod +x "${bwrap}" 2>/dev/null chmod +x "${extraction_tool}" 2>/dev/null chmod +x "${unionfs_fuse}" 2>/dev/null chmod +x "${compression_tool}" 2>/dev/null fi else if ! command -v bwrap 1>/dev/null; then echo "USE_SYS_UTILS is enabled, but bubblewrap is not installed!" echo "Please install it and run the script again." exit 1 fi bwrap=bwrap unionfs_fuse=unionfs if [ "${dwarfs_image}" = 1 ]; then if ! command -v dwarfs 1>/dev/null && ! command -v dwarfs2 1>/dev/null; then echo "USE_SYS_UTILS is enabled, but dwarfs is not installed!" echo "Please install it and run the script again." exit 1 fi if command -v dwarfs2 1>/dev/null; then mount_tool=dwarfs2 else mount_tool=dwarfs fi extraction_tool=dwarfsextract else if ! command -v squashfuse 1>/dev/null; then echo "USE_SYS_UTILS is enabled, but squashfuse is not installed!" echo "Please install it and run the script again." exit 1 fi mount_tool=squashfuse extraction_tool=unsquashfs fi show_msg "Using system-wide ${mount_tool} and bwrap" fi if [ "$1" = "-e" ] && [ -z "${script_is_symlink}" ]; then if command -v "${extraction_tool}" 1>/dev/null; then if [ "${dwarfs_image}" = 1 ]; then echo "Extracting the image..." mkdir "$(basename "${script}")"_files launch_wrapper "${extraction_tool}" -i "${script}" -o "$(basename "${script}")"_files -O "${offset}" echo "Done" else launch_wrapper "${extraction_tool}" -o "${offset}" -user-xattrs -d "$(basename "${script}")"_files "${script}" fi else echo "Extraction tool not found" exit 1 fi exit fi if [ "$1" = "-H" ] && [ -z "${script_is_symlink}" ]; then launch_wrapper "${bwrap}" --help exit fi run_bwrap () { unset sandbox_params unset unshare_net unset custom_home unset non_standard_home unset xsockets unset mount_opt unset command_line command_line=("${@}") if [ -n "${WAYLAND_DISPLAY}" ]; then wayland_socket="${WAYLAND_DISPLAY}" else wayland_socket="wayland-0" fi if [ -z "${XDG_RUNTIME_DIR}" ]; then XDG_RUNTIME_DIR="/run/user/${EUID}" fi # Handle non-standard HOME locations that are outside of our default # visibility scope if [ -n "${HOME}" ] && [ "$(echo "${HOME}" | head -c 6)" != "/home/" ]; then HOME_BASE_DIR="$(echo "${HOME}" | cut -d '/' -f2)" case "${HOME_BASE_DIR}" in tmp|mnt|media|run|var) ;; *) NEW_HOME=/home/"${USER}" non_standard_home+=(--tmpfs /home \ --bind "${HOME}" "${NEW_HOME}" \ --setenv "HOME" "${NEW_HOME}" \ --setenv "XDG_CONFIG_HOME" "${NEW_HOME}"/.config \ --setenv "XDG_DATA_HOME" "${NEW_HOME}"/.local/share) unset command_line for arg in "$@"; do if [[ "${arg}" == *"${HOME}"* ]]; then arg="$(echo "${arg/"$HOME"/"$NEW_HOME"}")" fi command_line+=("${arg}") done ;; esac fi if [ "${SANDBOX}" = 1 ]; then sandbox_params+=(--tmpfs /home \ --tmpfs /mnt \ --tmpfs /media \ --tmpfs /var \ --tmpfs /run \ --symlink /run /var/run \ --tmpfs /tmp \ --new-session) if [ -n "${non_standard_home[*]}" ]; then sandbox_params+=(--dir "${NEW_HOME}") else sandbox_params+=(--dir "${HOME}") fi if [ -n "${SANDBOX_LEVEL}" ] && [ "${SANDBOX_LEVEL}" -ge 2 ]; then sandbox_level_msg="(level 2)" sandbox_params+=(--dir "${XDG_RUNTIME_DIR}" \ --ro-bind-try "${XDG_RUNTIME_DIR}"/"${wayland_socket}" "${XDG_RUNTIME_DIR}"/"${wayland_socket}" \ --ro-bind-try "${XDG_RUNTIME_DIR}"/pulse "${XDG_RUNTIME_DIR}"/pulse \ --ro-bind-try "${XDG_RUNTIME_DIR}"/pipewire-0 "${XDG_RUNTIME_DIR}"/pipewire-0 \ --unshare-pid \ --unshare-user-try \ --unsetenv "DBUS_SESSION_BUS_ADDRESS") else sandbox_level_msg="(level 1)" sandbox_params+=(--bind-try "${XDG_RUNTIME_DIR}" "${XDG_RUNTIME_DIR}" \ --bind-try /run/dbus /run/dbus) fi if [ -n "${SANDBOX_LEVEL}" ] && [ "${SANDBOX_LEVEL}" -ge 3 ]; then sandbox_level_msg="(level 3)" DISABLE_NET=1 fi show_msg "Sandbox is enabled ${sandbox_level_msg}" fi if [ "${DISABLE_NET}" = 1 ]; then show_msg "Network is disabled" unshare_net=(--unshare-net) fi if [ -n "${HOME_DIR}" ]; then show_msg "Home directory is set to ${HOME_DIR}" if [ -n "${non_standard_home[*]}" ]; then custom_home+=(--bind "${HOME_DIR}" "${NEW_HOME}") else custom_home+=(--bind "${HOME_DIR}" "${HOME}") fi [ ! -d "${HOME_DIR}" ] && mkdir -p "${HOME_DIR}" fi # Set the XAUTHORITY variable if it's missing if [ -z "${XAUTHORITY}" ]; then XAUTHORITY="${HOME}"/.Xauthority fi # Mount X server sockets and XAUTHORITY xsockets+=(--tmpfs /tmp/.X11-unix) if [ -n "${non_standard_home[*]}" ] && [ "${XAUTHORITY}" = "${HOME}"/.Xauthority ]; then xsockets+=(--ro-bind-try "${XAUTHORITY}" "${NEW_HOME}"/.Xauthority \ --setenv "XAUTHORITY" "${NEW_HOME}"/.Xauthority) else xsockets+=(--ro-bind-try "${XAUTHORITY}" "${XAUTHORITY}") fi if [ "${DISABLE_X11}" != 1 ]; then if [ "$(ls /tmp/.X11-unix 2>/dev/null)" ]; then if [ -n "${SANDBOX_LEVEL}" ] && [ "${SANDBOX_LEVEL}" -ge 3 ]; then xsockets+=(--ro-bind-try /tmp/.X11-unix/X"${xephyr_display}" /tmp/.X11-unix/X"${xephyr_display}" \ --setenv "DISPLAY" :"${xephyr_display}") else for s in /tmp/.X11-unix/*; do xsockets+=(--bind-try "${s}" "${s}") done fi fi else show_msg "Access to X server is disabled" # Unset the DISPLAY and XAUTHORITY env variables and mount an # empty file to XAUTHORITY to invalidate it xsockets+=(--ro-bind-try "${working_dir}"/running_"${script_id}" "${XAUTHORITY}" \ --unsetenv "DISPLAY" \ --unsetenv "XAUTHORITY") fi if [ ! "$(ls "${mount_point}"/opt 2>/dev/null)" ] && [ -z "${SANDBOX}" ]; then mount_opt=(--bind-try /opt /opt) fi if ([ "${NVIDIA_HANDLER}" = 1 ] || [ "${USE_OVERLAYFS}" = 1 ]) && \ [ "$(ls "${overlayfs_dir}"/merged 2>/dev/null)" ]; then newroot_path="${overlayfs_dir}"/merged else newroot_path="${mount_point}" fi if [ "${RW_ROOT}" = 1 ]; then bind_root=(--bind "${newroot_path}" /) else bind_root=(--ro-bind "${newroot_path}" /) fi conty_variables="BASE_DIR DISABLE_NET DISABLE_X11 HOME_DIR QUIET_MODE \ SANDBOX SANDBOX_LEVEL USE_OVERLAYFS NVIDIA_HANDLER \ USE_SYS_UTILS XEPHYR_SIZE CUSTOM_MNT" for v in ${conty_variables}; do set_vars+=(--unsetenv "${v}") done [ -n "${LD_PRELOAD_ORIG}" ] && set_vars+=(--setenv LD_PRELOAD "${LD_PRELOAD_ORIG}") [ -n "${LD_LIBRARY_PATH_ORIG}" ] && set_vars+=(--setenv LD_LIBRARY_PATH "${LD_LIBRARY_PATH_ORIG}") if [ -n "${LC_ALL_ORIG}" ]; then set_vars+=(--setenv LC_ALL "${LC_ALL_ORIG}") else set_vars+=(--unsetenv LC_ALL) fi show_msg launch_wrapper "${bwrap}" \ "${bind_root[@]}" \ --dev-bind /dev /dev \ --ro-bind /sys /sys \ --bind-try /tmp /tmp \ --proc /proc \ --bind-try /home /home \ --bind-try /mnt /mnt \ --bind-try /media /media \ --bind-try /run /run \ --bind-try /var /var \ --ro-bind-try /usr/share/steam/compatibilitytools.d /usr/share/steam/compatibilitytools.d \ --ro-bind-try /etc/resolv.conf /etc/resolv.conf \ --ro-bind-try /etc/hosts /etc/hosts \ --ro-bind-try /etc/nsswitch.conf /etc/nsswitch.conf \ --ro-bind-try /etc/passwd /etc/passwd \ --ro-bind-try /etc/group /etc/group \ --ro-bind-try /etc/machine-id /etc/machine-id \ --ro-bind-try /etc/asound.conf /etc/asound.conf \ --ro-bind-try /etc/localtime /etc/localtime \ "${non_standard_home[@]}" \ "${sandbox_params[@]}" \ "${custom_home[@]}" \ "${mount_opt[@]}" \ "${xsockets[@]}" \ "${unshare_net[@]}" \ "${set_vars[@]}" \ --setenv PATH "${CUSTOM_PATH}" \ "${command_line[@]}" } exit_function () { sleep 3 rm -f "${working_dir}"/running_"${script_id}" if [ ! "$(ls "${working_dir}"/running_* 2>/dev/null)" ]; then if [ -d "${overlayfs_dir}"/merged ]; then fusermount"${fuse_version}" -uz "${overlayfs_dir}"/merged 2>/dev/null || \ umount --lazy "${overlayfs_dir}"/merged 2>/dev/null fi if [ -z "${CUSTOM_MNT}" ]; then fusermount"${fuse_version}" -uz "${mount_point}" 2>/dev/null || \ umount --lazy "${mount_point}" 2>/dev/null fi if [ ! "$(ls "${mount_point}" 2>/dev/null)" ] || [ -n "${CUSTOM_MNT}" ]; then rm -rf "${working_dir}" fi fi exit } trap_exit () { exit_function & } trap 'trap_exit' EXIT if [ "$(ls "${working_dir}"/running_* 2>/dev/null)" ] && [ ! "$(ls "${mount_point}" 2>/dev/null)" ]; then rm -f "${working_dir}"/running_* fi if [ -f "${nvidia_drivers_dir}"/lock ] && [ ! "$(ls "${working_dir}"/running_* 2>/dev/null)" ]; then rm -f "${nvidia_drivers_dir}"/lock fi if [ "${dwarfs_image}" = 1 ]; then mount_command=("${mount_tool}" \ "${script}" "${mount_point}" \ -o offset="${offset}" \ -o debuglevel=error \ -o workers="${dwarfs_num_workers}" \ -o mlock=try \ -o no_cache_image \ -o cache_files \ -o cachesize="${dwarfs_cache_size}" \ -o decratio=0.6 \ -o tidy_strategy=swap \ -o tidy_interval=5m) else mount_command=("${mount_tool}" \ -o offset="${offset}",ro \ "${script}" "${mount_point}") fi # Increase file descriptors limit in case soft and hard limits are different # Useful for unionfs-fuse and for some games ulimit -n $(ulimit -Hn) &>/dev/null # Mount the image mkdir -p "${mount_point}" if [ "$(ls "${mount_point}" 2>/dev/null)" ] || launch_wrapper "${mount_command[@]}"; then if [ "$1" = "-m" ] && [ -z "${script_is_symlink}" ]; then if [ ! -f "${working_dir}"/running_mount ]; then echo 1 > "${working_dir}"/running_mount echo "The image has been mounted to ${mount_point}" else rm -f "${working_dir}"/running_mount echo "The image has been unmounted" fi exit fi if [ "$1" = "-V" ] && [ -z "${script_is_symlink}" ]; then if [ -f "${mount_point}"/version ]; then cat "${mount_point}"/version else echo "Unknown version" fi exit fi if [ "$1" = "-d" ] && [ -z "${script_is_symlink}" ]; then applications_dir="${HOME}"/.local/share/applications/Conty if [ -d "${applications_dir}" ]; then rm -rf "${applications_dir}" echo "Desktop files have been removed" exit fi mkdir -p "${applications_dir}" cp -r "${mount_point}"/usr/share/applications "${applications_dir}"_temp cd "${applications_dir}"_temp || exit 1 unset variables vars="BASE_DIR DISABLE_NET DISABLE_X11 HOME_DIR SANDBOX SANDBOX_LEVEL USE_SYS_UTILS CUSTOM_MNT" for v in ${vars}; do if [ -n "${!v}" ]; then variables="${v}=\"${!v}\" ${variables}" fi done if [ -n "${variables}" ]; then variables="env ${variables} " fi echo "Exporting..." shift for f in *.desktop */ */*.desktop; do if [ "${f}" != "*.desktop" ] && [ "${f}" != "*/*.desktop" ] && [ "${f}" != "*/" ]; then if [ -d "${f}" ]; then mkdir -p "${applications_dir}"/"${f}" continue fi if [ -L "${f}" ]; then cp --remove-destination "${mount_point}"/"$(readlink "${f}")" "${f}" fi while read -r line; do line_function="$(echo "${line}" | head -c 4)" if [ "${line_function}" = "Name" ]; then line="${line} (Conty)" elif [ "${line_function}" = "Exec" ]; then line="Exec=${variables}\"${script}\" $@ $(echo "${line}" | tail -c +6)" elif [ "${line_function}" = "TryE" ]; then continue fi echo $line >> "${applications_dir}"/"${f%.desktop}"-conty.desktop done < "${f}" fi done mkdir -p "${HOME}"/.local/share cp -nr "${mount_point}"/usr/share/icons "${HOME}"/.local/share 2>/dev/null rm -rf "${applications_dir}"_temp echo "Desktop files have been exported" exit fi echo 1 > "${working_dir}"/running_"${script_id}" show_msg "Running Conty" export CUSTOM_PATH="/bin:/sbin:/usr/bin:/usr/sbin:/usr/lib/jvm/default/bin:/usr/local/bin:/usr/local/sbin:${PATH}" if [ "$1" = "-l" ] && [ -z "${script_is_symlink}" ]; then run_bwrap --ro-bind "${mount_point}"/var /var pacman -Q exit fi if [ "$1" = "-u" ] && [ -z "${script_is_symlink}" ] && [ -z "${CUSTOM_MNT}" ]; then export overlayfs_dir="${HOME}"/.local/share/Conty/update_overlayfs_"${script_md5}" rm -rf "${overlayfs_dir}" if mount_overlayfs; then USE_OVERLAYFS=1 QUIET_MODE=1 RW_ROOT=1 unset DISABLE_NET unset HOME_DIR unset SANDBOX_LEVEL unset SANDBOX unset DISABLE_X11 if ! touch test_rw 2>/dev/null; then cd "${HOME}" || exit 1 fi rm -f test_rw OLD_PWD="${PWD}" conty_update_temp_dir="${PWD}"/conty_update_temp_"${script_md5}" mkdir "${conty_update_temp_dir}" cd "${conty_update_temp_dir}" || exit 1 if command -v awk 1>/dev/null; then current_file_size="$(stat -c "%s" "${script}")" available_disk_space="$(df -P -B1 "${PWD}" | awk 'END {print $4}')" required_disk_space="$((current_file_size*7))" if [ "${available_disk_space}" -lt "${required_disk_space}" ]; then echo "Not enough free disk space" echo "You need at least $((required_disk_space/1024/1024)) MB of free space" exit 1 fi fi # Check if there are additional arguments passed shift if [ -n "$1" ]; then packagelist=("$@") # Check which packages to install and which ones to remove for i in "${packagelist[@]}"; do if [ "$(echo "${i}" | head -c 1)" = "-" ]; then pkgsremove+=" ${i:1}" else pkgsinstall+=" ${i}" fi done export pkgsremove export pkgsinstall fi clear echo "Updating and installing packages..." cp -r "${mount_point}"/etc/pacman.d/gnupg "${overlayfs_dir}"/gnupg export -f update_conty run_bwrap \ --bind "${overlayfs_dir}"/gnupg /etc/pacman.d/gnupg \ --bind "${overlayfs_dir}"/merged/var /var \ --bind-try /var/cache/pacman/pkg /var/cache/pacman/pkg_host \ bash -c update_conty if [ "${dwarfs_image}" = 1 ]; then compression_command=("${compression_tool}" -i "${overlayfs_dir}"/merged -o image "${dwarfs_comp_arguments[@]}") else compression_command=("${compression_tool}" "${overlayfs_dir}"/merged image "${squashfs_comp_arguments[@]}") fi clear echo "Creating an image..." launch_wrapper "${compression_command[@]}" if [ "${init_size}" -gt 0 ]; then tail -c +$((init_size+bash_size+1)) "${script}" | head -c "${script_size}" > conty-start.sh else head -c "${script_size}" "${script}" > conty-start.sh fi tail -c +$((init_size+bash_size+script_size+busybox_size+1)) "${script}" | head -c "${utils_size}" > utils.tar.gz # Combine into a single executable clear echo "Combining everything into a single executable..." cat "${working_dir}"/utils/init "${working_dir}"/utils/bash \ conty-start.sh "${working_dir}"/utils/busybox utils.tar.gz \ image > conty_updated.sh chmod +x conty_updated.sh mv -f "${script}" "${script}".old."${script_md5}" 2>/dev/null mv -f conty_updated.sh "${script}" 2>/dev/null || move_failed=1 fusermount"${fuse_version}" -uz "${overlayfs_dir}"/merged 2>/dev/null || \ umount --lazy "${overlayfs_dir}"/merged 2>/dev/null chmod -R 700 "${overlayfs_dir}" rm -rf "${overlayfs_dir}" "${conty_update_temp_dir}" clear echo "Conty has been updated!" if [ "${move_failed}" = 1 ]; then echo echo "Replacing ${script} with the new one failed!" echo echo "You can find conty_updated.sh in the current working" echo "directory or in your HOME." fi else echo "Failed to mount unionfs" echo "Cannot update Conty" fi exit fi if [ "${NVIDIA_HANDLER}" = 1 ]; then if [ -f /sys/module/nvidia/version ]; then unset NVIDIA_SHARED if [ ! "$(ls "${mount_point}"/usr/lib/libGLX_nvidia.so.*.* 2>/dev/null)" ]; then export overlayfs_dir="${overlayfs_shared_dir}" export nvidia_drivers_dir="${nvidia_drivers_shared_dir}" export NVIDIA_SHARED=1 fi if [ -f "${nvidia_drivers_dir}"/lock ]; then echo "Nvidia driver is currently installing" echo "Please wait a moment and run Conty again" exit 1 fi if mount_overlayfs; then show_msg "Nvidia driver handler is enabled" unset nvidia_skip_install unset nvidia_driver_version nvidia_driver_version="$(cat /sys/module/nvidia/version)" if [ "$(ls "${mount_point}"/usr/lib/libGLX_nvidia.so.*.* 2>/dev/null)" ]; then container_nvidia_version="$(basename "${mount_point}"/usr/lib/libGLX_nvidia.so.*.* | tail -c +18)" fi if [ -f "${nvidia_drivers_dir}"/current-nvidia-version ] && \ [ ! "$(ls "${overlayfs_dir}"/up 2>/dev/null)" ]; then rm -f "${nvidia_drivers_dir}"/current-nvidia-version fi if [ -z "${nvidia_driver_version}" ] || [ "${nvidia_driver_version}" = "" ]; then echo "Unable to determine Nvidia driver version" rm -f "${nvidia_drivers_dir}"/current-nvidia-version nvidia_skip_install=1 fi if [ "${nvidia_driver_version}" = "${container_nvidia_version}" ]; then rm -f "${nvidia_drivers_dir}"/current-nvidia-version nvidia_skip_install=1 fi if [ "$(cat "${nvidia_drivers_dir}"/current-nvidia-version 2>/dev/null)" = "${nvidia_driver_version}" ]; then nvidia_skip_install=1 fi if [ -z "${nvidia_skip_install}" ]; then mkdir -p "${nvidia_drivers_dir}" echo > "${nvidia_drivers_dir}"/lock export nvidia_driver_version export -f nvidia_driver_handler DISABLE_NET=0 QUIET_MODE=1 RW_ROOT=1 run_bwrap --tmpfs /tmp --tmpfs /var --tmpfs /run \ --bind "${nvidia_drivers_dir}" "${nvidia_drivers_dir}" \ bash -c nvidia_driver_handler rm -f "${nvidia_drivers_dir}"/lock fi if [ -n "${NVIDIA_SHARED}" ]; then fusermount"${fuse_version}" -uz "${overlayfs_dir}"/merged 2>/dev/null || \ umount --lazy "${overlayfs_dir}"/merged 2>/dev/null rm -f "${overlayfs_shared_dir}"/up/etc/ld.so.cache export overlayfs_dir="${HOME}"/.local/share/Conty/overlayfs_"${script_md5}" export nvidia_drivers_dir="${overlayfs_dir}"/nvidia mount_overlayfs share_nvidia if [ "$(cat "${nvidia_drivers_dir}"/ld.so.cache.nvidia 2>/dev/null)" != "${nvidia_driver_version}" ]; then QUIET_MODE=1 RW_ROOT=1 run_bwrap ldconfig echo "${nvidia_driver_version}" > "${nvidia_drivers_dir}"/ld.so.cache.nvidia fi fi else echo "Nvidia driver handler disabled due to unionfs errors" unset NVIDIA_HANDLER fi else unset NVIDIA_HANDLER fi if [ -z "${NVIDIA_SHARED}" ] && [ ! -f "${nvidia_drivers_dir}"/current-nvidia-version ]; then unset NVIDIA_HANDLER fi fi if [ "${USE_OVERLAYFS}" = 1 ]; then if mount_overlayfs; then show_msg "Using unionfs" RW_ROOT=1 else echo "Failed to mount unionfs" unset USE_OVERLAYFS fi fi # If SANDBOX_LEVEL is 3, run Xephyr and openbox before running applications if [ "${SANDBOX}" = 1 ] && [ -n "${SANDBOX_LEVEL}" ] && [ "${SANDBOX_LEVEL}" -ge 3 ]; then if [ -f "${mount_point}"/usr/bin/Xephyr ]; then if [ -z "${XEPHYR_SIZE}" ]; then XEPHYR_SIZE="800x600" fi xephyr_display="$((script_id+2))" if [ -S /tmp/.X11-unix/X"${xephyr_display}" ]; then xephyr_display="$((script_id+10))" fi QUIET_MODE=1 DISABLE_NET=1 SANDBOX_LEVEL=2 run_bwrap \ --bind-try /tmp/.X11-unix /tmp/.X11-unix \ Xephyr -noreset -ac -br -screen "${XEPHYR_SIZE}" :"${xephyr_display}" &>/dev/null & sleep 1 xephyr_pid=$! QUIET_MODE=1 run_bwrap openbox & sleep 1 else echo "SANDBOX_LEVEL is set to 3, but Xephyr is not present inside the container." echo "Xephyr is required for this SANDBOX_LEVEL." exit 1 fi fi if [ -n "${script_is_symlink}" ] && [ -f "${mount_point}"/usr/bin/"${script_name}" ]; then export CUSTOM_PATH="/bin:/sbin:/usr/bin:/usr/sbin:/usr/lib/jvm/default/bin" show_msg "Autostarting ${script_name}" run_bwrap "${script_name}" "$@" elif [ "$1" = "-g" ] || ([ ! -t 0 ] && [ -z "${1}" ] && [ -z "${script_is_symlink}" ]); then export -f gui run_bwrap bash -c gui else run_bwrap "$@" fi if [ -n "${xephyr_pid}" ]; then wait "${xephyr_pid}" fi else echo "Mounting the image failed!" exit 1 fi exit