<commit_before>config={}
config.profile = loader.extra[1]
config.home_dir = loader.extra[2]
config.sandboxer_dir = loader.extra[3]
config.pwd = loader.extra[4]
config.sandbox_uid = loader.extra[5]
config.tmpdir = loader.extra[6]
config.ctldir = loader.extra[7]
config.uid = loader.extra[8]
config.gid = loader.extra[9]

-- define some defaults to use inside user-sandbox config files, to make them more portable and simple
-- TODO: make different defaults-sets optimized for different linux-distributions (maintain it in different config files, included there)

defaults={}

-- base directory

-- you may change this in case of debug.
-- default value is config.ctldir - automatically generated sandbox directory unique to config file, located in /tmp.
-- base directory for all internal sandbox control stuff, used by sandboxer system,
-- this directory will be automatically created\removed by sandboxer system.
-- automatically generated directories and files also stored here.
-- this directory should be unique for each sandbox config file, and should be placed on tmpfs.
-- TODO: it will be automatically removed when all processes inside sandbox terminated.

defaults.basedir=config.ctldir

-- signals list
defaults.signals=
{
SIGHUP=1,
SIGINT=2,
SIGQUIT=3,
SIGILL=4,
SIGTRAP=5,
SIGABRT=6,
SIGIOT=6,
SIGBUS=7,
SIGFPE=8,
SIGKILL=9,
SIGUSR1=10,
SIGSEGV=11,
SIGUSR2=12,
SIGPIPE=13,
SIGALRM=14,
SIGTERM=15,
SIGSTKFLT=16,
SIGCHLD=17,
SIGCONT=18,
SIGSTOP=19,
SIGTSTP=20,
SIGTTIN=21,
SIGTTOU=22,
SIGURG=23,
SIGXCPU=24,
SIGXFSZ=25,
SIGVTALRM=26,
SIGPROF=27,
SIGWINCH=28,
SIGIO=29,
SIGPWR=30,
SIGSYS=31,
}

defaults.custom_commands={}
-- TODO: move this to chroot table (not complete yet)

defaults.custom_commands.etc=
{
'mkdir -p "etc"',
'2>/dev/null cp -rf "/etc/zsh"* "etc"; true',
'2>/dev/null cp "/etc/yp.conf" "etc"; true',
'2>/dev/null cp "/etc/wgetrc" "etc"; true',
'2>/dev/null cp "/etc/vimrc" "etc"; true',
'2>/dev/null cp "/etc/vdpau_wrapper.cfg" "etc"; true',
'cp "/etc/termcap" "etc"',
'2>/dev/null cp -rf "/etc/security" "etc"; true',
'cp "/etc/resolv.conf" "etc"',
'2>/dev/null cp -r "/etc/pulse" "etc"; true',
'cp "/etc/profile" "etc"',
'cp -rf "/etc/profile.d" "etc"',
'cp "/etc/protocols" "etc"',
'2>/dev/null cp "/etc/os-release" "etc"; true',
'cp "/etc/nsswitch.conf" "etc"',
'cp "/etc/nscd.conf" "etc"',
'2>/dev/null cp "/etc/networks" "etc"; true',
'rm -f "etc/mtab"; ln -s "/proc/self/mounts" "etc/mtab"',
'2>/dev/null cp "/etc/mime.types" "etc"; true',
'cp "/etc/localtime" "etc"',
'cp -rf "/etc/ld.so"* "etc"',
'2>/dev/null cp "/etc/libao.conf" "etc"; true',
'2>/dev/null cp "/etc/ksh.kshrc" "etc"; true',
'2>/dev/null cp "/etc/krb5.conf" "etc"; true',
'2>/dev/null cp -rf "/etc/kde4" "etc"; true',
'2>/dev/null cp -rf "/etc/java" "etc"; true',
'2>/dev/null cp "/etc/inputrc" "etc"; true',
'cp "/etc/host"* "etc"',
'cp "/etc/HOSTNAME" "etc"',
'2>/dev/null cp "/etc/freshwrapper.conf" "etc"; true',
'2>/dev/null cp "/etc/ethers" "etc"; true',
'2>/dev/null cp "/etc/drirc" "etc"; true',
'2>/dev/null cp "/etc/DIR_COLORS" "etc"; true',
'2>/dev/null cp "/etc/dialogrc" "etc"; true',
'2>/dev/null cp "/etc/csh"* "etc"; true',
'2>/dev/null cp -rf "/etc/ca-certificates" "etc"; true',
'2>/dev/null cp -rf "/etc/bash"* "etc"; true',
'2>/dev/null cp -rf "/etc/mc" "etc"; true',
'2>/dev/null cp "/etc/asound-pulse.conf" "etc"; true',
'2>/dev/null cp "/etc/alsa-pulse.conf" "etc"; true',
'2>/dev/null cp -rf "/etc/alternatives" "etc"; true',
'2>/dev/null cp -rf "/etc/alias"* "etc"; true',
'2>/dev/null cp "/etc/adjtime" "etc"; true',
'2>/dev/null cp -rf "/etc/less"* "etc"; true',
}

defaults.custom_commands.pwd=
{
'mkdir -p "etc"',
-- passwd and group files generation
'getent passwd root nobody > "etc/passwd"',
'echo "sandbox:x:'..config.uid..':'..config.gid..':sandbox:/home/sandbox:/bin/bash" >> "etc/passwd"',
'getent group root nobody nogroup > "etc/group"',
'echo "sandbox:x:'..config.gid..':" >> "etc/group"',
}

defaults.custom_commands.home=
{
'mkdir -p "'..loader.path.combine(loader.workdir,"userdata-"..config.sandbox_uid)..'"',
'test ! -d "'..loader.path.combine(loader.workdir,"userdata-"..config.sandbox_uid,"sandbox")..'" && \
 2>/dev/null cp -rf /etc/skel "'..loader.path.combine(loader.workdir,"userdata-"..config.sandbox_uid,"sandbox")..'" || \
 true',
}

defaults.env={}

defaults.env.blacklist_main=
{ -- main blacklist, include variables that may leak sensitive information
-- or will be incorrect inside sandbox because of isolation. (TODO: ability to use subsystems defined by such variables)
-- this list does not include variables for current X11 session and DE,
-- does not include variables regad
"DBUS_SESSION_BUS_ADDRESS",
"FROM_HEADER",
"GPG_AGENT_INFO",
"GPG_TTY",
"MAIL",
"OLDPWD",
"SHELL",
"SHLVL",
"SSH_AGENT_PID",
"SSH_ASKPASS",
"SSH_AUTH_SOCK",
"WINDOWID",
"TERM",
}

defaults.env.blacklist_audio=
{ -- blacklist that include variables used to alsa\pulse env setup,
-- recommended to include if your sandboxed app is not using audio.
-- may be safely used with pulseaudio feature (it will define all needed variables automatically),
-- so, it is recommended to include this blacklist in any case<commit_msg>sandboxer.pre.lua: add and update .Xauthority file when constructing default home directory<commit_after>config={}
config.profile = loader.extra[1]
config.home_dir = loader.extra[2]
config.sandboxer_dir = loader.extra[3]
config.pwd = loader.extra[4]
config.sandbox_uid = loader.extra[5]
config.tmpdir = loader.extra[6]
config.ctldir = loader.extra[7]
config.uid = loader.extra[8]
config.gid = loader.extra[9]

-- define some defaults to use inside user-sandbox config files, to make them more portable and simple
-- TODO: make different defaults-sets optimized for different linux-distributions (maintain it in different config files, included there)

defaults={}

-- base directory

-- you may change this in case of debug.
-- default value is config.ctldir - automatically generated sandbox directory unique to config file, located in /tmp.
-- base directory for all internal sandbox control stuff, used by sandboxer system,
-- this directory will be automatically created\removed by sandboxer system.
-- automatically generated directories and files also stored here.
-- this directory should be unique for each sandbox config file, and should be placed on tmpfs.
-- TODO: it will be automatically removed when all processes inside sandbox terminated.

defaults.basedir=config.ctldir

-- signals list
defaults.signals=
{
SIGHUP=1,
SIGINT=2,
SIGQUIT=3,
SIGILL=4,
SIGTRAP=5,
SIGABRT=6,
SIGIOT=6,
SIGBUS=7,
SIGFPE=8,
SIGKILL=9,
SIGUSR1=10,
SIGSEGV=11,
SIGUSR2=12,
SIGPIPE=13,
SIGALRM=14,
SIGTERM=15,
SIGSTKFLT=16,
SIGCHLD=17,
SIGCONT=18,
SIGSTOP=19,
SIGTSTP=20,
SIGTTIN=21,
SIGTTOU=22,
SIGURG=23,
SIGXCPU=24,
SIGXFSZ=25,
SIGVTALRM=26,
SIGPROF=27,
SIGWINCH=28,
SIGIO=29,
SIGPWR=30,
SIGSYS=31,
}

defaults.custom_commands={}
-- TODO: move this to chroot table (not complete yet)

defaults.custom_commands.etc=
{
'mkdir -p "etc"',
'2>/dev/null cp -rf "/etc/zsh"* "etc"; true',
'2>/dev/null cp "/etc/yp.conf" "etc"; true',
'2>/dev/null cp "/etc/wgetrc" "etc"; true',
'2>/dev/null cp "/etc/vimrc" "etc"; true',
'2>/dev/null cp "/etc/vdpau_wrapper.cfg" "etc"; true',
'cp "/etc/termcap" "etc"',
'2>/dev/null cp -rf "/etc/security" "etc"; true',
'cp "/etc/resolv.conf" "etc"',
'2>/dev/null cp -r "/etc/pulse" "etc"; true',
'cp "/etc/profile" "etc"',
'cp -rf "/etc/profile.d" "etc"',
'cp "/etc/protocols" "etc"',
'2>/dev/null cp "/etc/os-release" "etc"; true',
'cp "/etc/nsswitch.conf" "etc"',
'cp "/etc/nscd.conf" "etc"',
'2>/dev/null cp "/etc/networks" "etc"; true',
'rm -f "etc/mtab"; ln -s "/proc/self/mounts" "etc/mtab"',
'2>/dev/null cp "/etc/mime.types" "etc"; true',
'cp "/etc/localtime" "etc"',
'cp -rf "/etc/ld.so"* "etc"',
'2>/dev/null cp "/etc/libao.conf" "etc"; true',
'2>/dev/null cp "/etc/ksh.kshrc" "etc"; true',
'2>/dev/null cp "/etc/krb5.conf" "etc"; true',
'2>/dev/null cp -rf "/etc/kde4" "etc"; true',
'2>/dev/null cp -rf "/etc/java" "etc"; true',
'2>/dev/null cp "/etc/inputrc" "etc"; true',
'cp "/etc/host"* "etc"',
'cp "/etc/HOSTNAME" "etc"',
'2>/dev/null cp "/etc/freshwrapper.conf" "etc"; true',
'2>/dev/null cp "/etc/ethers" "etc"; true',
'2>/dev/null cp "/etc/drirc" "etc"; true',
'2>/dev/null cp "/etc/DIR_COLORS" "etc"; true',
'2>/dev/null cp "/etc/dialogrc" "etc"; true',
'2>/dev/null cp "/etc/csh"* "etc"; true',
'2>/dev/null cp -rf "/etc/ca-certificates" "etc"; true',
'2>/dev/null cp -rf "/etc/bash"* "etc"; true',
'2>/dev/null cp -rf "/etc/mc" "etc"; true',
'2>/dev/null cp "/etc/asound-pulse.conf" "etc"; true',
'2>/dev/null cp "/etc/alsa-pulse.conf" "etc"; true',
'2>/dev/null cp -rf "/etc/alternatives" "etc"; true',
'2>/dev/null cp -rf "/etc/alias"* "etc"; true',
'2>/dev/null cp "/etc/adjtime" "etc"; true',
'2>/dev/null cp -rf "/etc/less"* "etc"; true',
}

defaults.custom_commands.pwd=
{
'mkdir -p "etc"',
-- passwd and group files generation
'getent passwd root nobody > "etc/passwd"',
'echo "sandbox:x:'..config.uid..':'..config.gid..':sandbox:/home/sandbox:/bin/bash" >> "etc/passwd"',
'getent group root nobody nogroup > "etc/group"',
'echo "sandbox:x:'..config.gid..':" >> "etc/group"',
}

defaults.custom_commands.home=
{
'mkdir -p "'..loader.path.combine(loader.workdir,"userdata-"..config.sandbox_uid)..'"',
'test ! -d "'..loader.path.combine(loader.workdir,"userdata-"..config.sandbox_uid,"sandbox")..'" && \
 2>/dev/null cp -rf /etc/skel "'..loader.path.combine(loader.workdir,"userdata-"..config.sandbox_uid,"sandbox")..'" || \
 true',
 'cp "$HOME/.Xauthority" "'..loader.path.combine(loader.workdir,"userdata-"..config.sandbox_uid,"sandbox",".Xauthority")..'"',
}

defaults.env={}

defaults.env.blacklist_main=
{ -- main blacklist, include variables that may leak sensitive information
-- or will be incorrect inside sandbox because of isolation. (TODO: ability to use subsystems defined by such variables)
-- this list does not include variables for current X11 session and DE,
-- does not include variables regad
"DBUS_SESSION_BUS_ADDRESS",
"FROM_HEADER",
"GPG_AGENT_INFO",
"GPG_TTY",
"MAIL",
"OLDPWD",
"SHELL",
"SHLVL",
"SSH_AGENT_PID",
"SSH_ASKPASS",
"SSH_AUTH_SOCK",
"WINDOWID",
"TERM",
}

defaults.env.blacklist_audio=
{ -- blacklist that include variables used to alsa\pulse env setup,
-- recommended to include if your sandboxed app is not using audio.
-- may be safely used with pulseaudio feature (it will define all needed variables automatically),
-- so, it is recommended to include this blacklist in any case
{'fraction_non_alphanumeric': 0.19388239764415313, 'fraction_numerical': 0.01918875273107248, 'mean_word_length': 4.489051094890511, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 79, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1432888', 'n_tokens_mistral': 4116, 'n_tokens_neox': 3977, 'n_words': 1084}