EDIT : A later version to that of the script/code posted here is available in this post -> viewtopic.php?p=16475#p16475
Updated version of May 2019 code. Crude and hard coded, but works and could be used as a template. Similar to a EasyOS container.
Basically when run (after making the appropriate edits to point to wherever), it starts a full screen Xephyr (another X server), using fd64.sfs as the base, and chroots into that with various capabilities dropped. When in that environment, open a terminal and run seamonkey (as root) ... but where that root is a duff-root (more restricted than even spot in a conventional Puppy).
My fd64.sfs is in /mnt/sda1/FATDOG811-FINAL, I use /mnt/sda4/changes as the working folder (needs to be a ext2/3/4 filesystem outside of 'Puppy space' i.e. on HDD) and /mnt/sda4/shared as a shared folder. Edit the pointers to those to wherever you might use instead.
I have pflask and empty installed, can't remember if that is by default or whether I installed them using gslapt/package manager.
To exit its alt-F4, or if you have other windows already running in the main session you can alt-tab to them. Some/many menu options might not work, primarily I use it to run seamonkey is a contained manner by opening a terminal and typing 'seamonkey' (the seamonkey in the Menu wont work)
If you'd rather run jwm instead of lxqt panel/openbox, then remove the
echo "lxqt-panel &" >>top/init
echo "openbox" >>top/init
lines and replace them with
echo "jwm" >>top/init
You might also want to change the dpi value from 144 (the more usual choice is 96).
Code: Select all
#!/bin/sh
# Rufwoof Jan 2021 (updated May 2019 version). Comments at end
xterm & # added so have at least one window I can alt-tab to out of the container
[ ! -d /mnt/sda4/shared ] && mkdir /mnt/sda4/shared # as a shared folder
CHANGES_LOC=/mnt/sda4/changes # Non pre-existing ext fs work folder
MAIN_SFS=/mnt/sda1/FATDOG811-FINAL/fd64.sfs # Where the main sfs is located
# Xephyr parameters
XP="-fullscreen -title container -name Xephyr2 -dpi 144 -nolisten tcp"
# pflask parameters
PF="--mount=bind:/mnt/sda4/shared:/home/shared"
PF="${PF} --keepenv --no-ipcns --no-netns"
PF="${PF} --mount=bind:/mnt/sda4/shared:/home/shared"
PF="${PF} --mount=bind:/etc/resolv.conf:/etc/resolv.conf" # dns (internet)
PF="${PF} --mount=bind:/dev/snd:/dev/snd"
PF="${PF} --mount=bind:/dev/mixer:/dev/mixer"
PF="${PF} --caps=all,-sys_admin,-sys_boot,-sys_chroot,-sys_ptrace,"
PF="${PF}-sys_time,-sys_tty_config,-chown,-kill,-dac_override,"
PF="${PF}-dac_read_search,-fowner,-setfcap,-setpcap,-net_admin,"
PF="${PF}-mknod,-sys_module,-sys_nice,-sys_resource"
PF="${PF} --chroot=${CHANGES_LOC}/top"
# Avoid double click 2 instances
N=`date +%s` # Seconds since January 1970
if [ -f /tmp/container.run ];then
L=`cat /tmp/container.run`
D=`expr $N - $L`
if [ $D -lt 2 ];then
exit # quick 2 launches (doubled clicked ignore second click)
fi
fi
echo $N >/tmp/container.run
# Create a separate X instance so isolated from the main real root X
T=`ps -ef | grep Xephyr2 | wc -l`
if [ $T -ne 2 ];then
Xephyr :2 ${XP} &
else
exit # Xephyr2 already running
fi
# Create a changes folder, sfs mount point for main.sfs and top layer
# folders and aufs mount to combine changes and sfs folders -> top
cd ${CHANGES_LOC}
# Check for possible hangover - such as if restarted X and clean out if so
if [ -d top ] || [ -d sfs ] || [ -d changes ]; then
umount top sfs
rm -rf changes
rmdir top sfs
fi
mkdir top sfs changes
mount -r -t squashfs ${MAIN_SFS} sfs
mount -t aufs -o br=changes:sfs none top
# create a script to run inside the chroot (i.e. must be a script, not a bin)
echo "#!/bin/sh" >top/init
echo "lxqt-panel &" >>top/init
echo "openbox" >>top/init
chmod +x top/init
# The big Xephyr capabilities dropped chroot switch
DISPLAY=:2 empty -f unshare -m pflask ${PF} -- /init
wait # above backgrounds, so we wait until that ends
# Clean up
killall Xephyr
umount top sfs
rm -rf changes
rmdir top sfs
rm /tmp/container.run
############################################################################
# FOR FATDOG 811 ...
#
# Aufs mounts changes (initial empty rw folder), main sfs, that combined
# is visible/accessed via folder 'top', that we chroot into
#
# chroot with chroot capability dropped (to prevent chroot out of the chroot)
# using another X session (Xephyr) to isolate it from the main X session.
# We chroot using pflask as that makes things easier into the top folder
# applying further restrictions. We use the main sfs as our base for the
# chroot, so very low overheads.
#
# alt-F4 closes the Xephyr container (if not then ctrl-shift to unfocus
# mouse/keyboard.
# alt Tab to step to another window in main system, but if use
# xdotool keydown alt key Tab;xdotool keyup alt .... it doesn't
# work (as intended i.e. it's locked into the "container").
# seamonkey from menu doesn't work, run seamonkey from within urxvt
# We use DISPLAY :2 for the Xephyr server
#
# Requires empty, pflask and a ext filesystem to create/work within
#
# I use fatdog multi-session save type frugal boot, and periodically I've
# re-merged the save files into fd64.sfs so my fd64.sfs isn't the standard
# version (merging changes and not copying fd64.sfs to ram helps keep ram
# usage low).
############################################################################When in a terminal, check things out ... you can't for instance see the HDD's, nor chroot and if you run htop you'll see very few things. Can't pipe things into the main session window, nor keylog (or stuff key sequences). Whilst operational speed is as fast as the main session (when for instance viewing youtubes).
Instead of launching openbox/lxqt panel (or jwm), you could set it to just run seamonkey - as purely a form of contained browser.
.