sandbox

#!/bin/bash

usage()
{
  echo "Usage: $0 [OPTIONS]... [COMMAND]"
  echo ""
  echo "Sandboxes"
  echo "    -n NAME     name the sandbox"
  echo "    -p          permanent sandbox"
  echo "    -m          in-memory sandbox"
  echo "    -d          delete the named sandbox"
  echo "    -l          list all sandboxes"
  echo ""
  echo "Sandgrains"
  echo "    -g GRAIN    comma separated grains, or 'list' to see all"
  echo ""
  echo "Sandpits"
  echo "    -r NAME     new sandpit name"
  echo "    -i PIT      initialise sandpit"
  echo "    -v VARIENT  sandpit varient to install (eg. vivid)"
  echo ""
  echo "X-Session"
  echo "    -x          start an x-session"
  echo "    -f          start fullscreen (xephyr)"
  echo ""
  echo "Other"
  echo "    -s PATH     set sandbox root directory (eg. usb stick)"
  echo "    -o          opens your filemanager to see the sandbox's filesystem"
  echo "    -h          show this help text"
  echo "    COMMAND     command to run instead of shell"
  echo ""
  echo "See https://github.com/cal2195/Sandbox for more information!"
}

checkCommand()
{
  if command -v $1 >/dev/null 2>&1; then
    return 0
  fi
  if [[ $(( $(date +%s) - $(stat -c %Z $tmprt/var/cache/apt/pkgcache.bin) )) -gt $(( 24 * 60 * 60 )) ]]; then
    sudo apt-get update
  fi
  sudo apt-get install $1
}

commitChanges()
{
  echo "*WARNING* You are about to commit all changes from $NAME to host system!"
  read -p "Are you sure you want to do this? (y/N)" answer
  case ${answer:0:1} in
      y|Y)
          sudo rsync -aAXvh --no-compress --progress $tmprw/ $SYSROOT
          if [ "$?" -eq "0" ]
          then
            sudo rm -r $tmprw
            echo "All changes commited!"
          else
            echo "Error committing changes! :("
          fi
          exit
          ;;
      *)
          exit
          ;;
  esac
}

checkUnionFuse()
{
  if command -v unionfs >/dev/null 2>&1; then
    UNION="unionfs"
  else
    if command -v unionfs-fuse >/dev/null 2>&1; then
      UNION="unionfs-fuse"
    else
      NEEDSDEPS=true
    fi
  fi
}

installPits()
{
  checkCommand debootstrap
  sudo debootstrap $PITDIST $SANDBOXROOT/$PITDEST/$SANDPIT
  sudo chroot $SANDBOXROOT/$PITDEST/$SANDPIT adduser $USER
  sudo chroot $SANDBOXROOT/$PITDEST/$SANDPIT adduser $USER sudo
  sudo cp /etc/resolv.conf $SANDBOXROOT/$PITDEST/$SANDPIT/etc/resolv.conf
  sudo cp /etc/hosts $SANDBOXROOT/$PITDEST/$SANDPIT/etc/hosts
}

configurePits()
{
  if [ "$INSTALLPIT" == true ] && [ "$PITFILE" != "base" ]; then
    sudo chroot $SANDBOXROOT/$PITDEST/$SANDPIT apt-get install -y software-properties-common
    sudo chroot $SANDBOXROOT/$PITDEST/$SANDPIT add-apt-repository "deb http://archive.ubuntu.com/ubuntu $(lsb_release -sc) main universe restricted multiverse"
    sudo chroot $SANDBOXROOT/$PITDEST/$SANDPIT apt-get update
    checkCommand curl
    curl -sL "https://github.com/cal2195/Sandbox/raw/sandpit/sandpits/$PITFILE.pit" | PITDEST=$SANDBOXROOT/$PITDEST/$SANDPIT PITDIST=$PITDIST /bin/bash
  fi
}

setupSandboxFolders()
{
  if [ "$NAME" == "" ]; then
    if [ "$RAMDISK" == true ]; then
      tmprw="$MNTDIR/$(cat /dev/urandom | tr -cd 'a-z0-9' | head -c 8)/rw"
      tmprt="$MNTDIR/$(cat /dev/urandom | tr -cd 'a-z0-9' | head -c 8)/rt"
      NAME="rambox"
    else
      tmprw="/tmp/$(cat /dev/urandom | tr -cd 'a-z0-9' | head -c 8)/rw"
      tmprt="/tmp/$(cat /dev/urandom | tr -cd 'a-z0-9' | head -c 8)/rt"
      NAME="tmpbox"
    fi
    mkdir -p $tmprw
    mkdir -p $tmprt
  else
    mkdir -p $MNTDIR/$NAME/rw
    mkdir -p $MNTDIR/$NAME/rt
    tmprw="$MNTDIR/$NAME/rw"
    tmprt="$MNTDIR/$NAME/rt"
  fi
}

mountSandbox()
{
  #Mount unionfs
  sudo $UNION -o allow_other,default_permissions,cow,max_files=32000,use_ino,suid,dev,nonempty $tmprw=rw:$SYSROOT=ro $tmprt
  #Mount system folders
  sudo mount -t proc proc $tmprt/proc
  sudo mount -t sysfs sys $tmprt/sys
  sudo mount --rbind /dev $tmprt/dev
  sudo mount --rbind /run $tmprt/run
  #sudo mount --rbind /var/run/dbus $tmprt/var/run/dbus
}

configureSandbox()
{
  #Change PS1 prompt & set DISPLAY
  PSSAND="\"(sandbox) \[\033[38;5;118m\]\u\[$(tput sgr0)\]\[\033[38;5;124m\]@$NAME\[$(tput sgr0)\]\[\033[38;5;15m\]:\[$(tput sgr0)\]\[\033[38;5;6m\][\w]\[$(tput sgr0)\]\[\033[38;5;6m\]>\[$(tput sgr0)\]\[\033[38;5;15m\] \[$(tput sgr0)\]\""
  sudo grep -q -F "DISPLAY=${NEWDISPLAY}" $tmprt/etc/environment || echo "DISPLAY=${NEWDISPLAY}" | sudo tee --append $tmprt/etc/environment > /dev/null
  sudo grep -q -F "PS1=$PSSAND" $tmprt/etc/environment || echo "PS1=$PSSAND" | sudo tee --append $tmprt/etc/environment > /dev/null
  sudo grep -q -F "DISPLAY=${NEWDISPLAY}" $tmprt/$HOME/.bashrc || echo "DISPLAY=${NEWDISPLAY}" | sudo tee --append $tmprt/$HOME/.bashrc > /dev/null
  sudo grep -q -F "PS1=$PSSAND" $tmprt/$HOME/.bashrc || echo "PS1=$PSSAND" | sudo tee --append $tmprt/$HOME/.bashrc > /dev/null
}

installSandgrains()
{
  if [ "$GRAINS" != "" ]; then
    if [[ $(( $(date +%s) - $(stat -c %Z $tmprt/var/cache/apt/pkgcache.bin) )) -gt $(( 24 * 60 * 60 )) ]]; then
      sudo chroot $tmprt apt-get update
    fi
    sudo chroot $tmprt apt-get install -y curl
    for grain in $(echo $GRAINS | sed "s/,/ /g")
    do
      #Install each grain
      sudo chroot $tmprt curl -sL "https://github.com/cal2195/Sandbox/raw/master/sandgrains/$grain.grain" | sudo chroot $tmprt /bin/bash
    done
  fi
}

startXSession()
{
  sudo chroot $tmprt rm -r /tmp/.X11-unix/*
  sudo chroot $tmprt su - $USER -c "sudo rm .Xauthority*"
  if [[ "$(tty)" == *"tty"* ]]; then
    sudo chroot $tmprt su - $USER -c "startx -- :2"
  else
    if command -v Xephyr >/dev/null 2>&1; then
      if [ "$USINGPIT" == true ]; then
        $XEPHYR &
        sudo chroot $tmprt su - $USER -c "./start.sh"
      else
        xhost +
        sudo chroot $tmprt su - $USER -c "DISPLAY=$DISPLAY startx -- /usr/bin/$XEPHYR"
      fi
    else
      echo "-x requires Xephyr installed, unless sandbox is run in a tty! try 'sudo apt-get install xserver-xephyr'"
    fi
  fi
}

#Default values
REMOVEAFTER=true
PERMANENT=false
DELETENOW=false
LISTBOXES=false
RAMDISK=false
NEEDSDEPS=false
XSESSION=false
VIEWOVERLAY=false
NEWDISPLAY=$DISPLAY
SANDBOXROOT="$HOME/.sandbox"
MNTDIR="/tmp/sandbox"
SYSROOT="/"
COMMITCHANGES=false
ENCRYPT=false
#Default Debootstrap
USINGPIT=false
INSTALLPIT=false
PITFILE="base"
PITDIST="$(lsb_release -sc)"
PITDEST=".pits"
#Commands
XEPHYR="Xephyr -ac -resizeable :1"

#Check for unionfs-fuse
checkUnionFuse

#Parse commands
while getopts ":n:hdlpmg:xor:i:v:s:fce" opt; do
  case $opt in
    n)
      NAME=$OPTARG
      REMOVEAFTER=false
      ;;
    d)
      DELETENOW=true
      ;;
    p)
      PERMANENT=true
      ;;
    m)
      RAMDISK=true
      echo "Warning - using ram disk. Make sure you know what you're doing!"
      ;;
    l)
      LISTBOXES=true
      ;;
    r)
      USINGPIT=true
      SANDPIT=$OPTARG
      ;;
    i)
      if [ "$OPTARG" == "list" ]; then
        checkCommand curl
        echo "Getting list of sandpits..."
        curl -sL "https://github.com/cal2195/Sandbox/raw/sandpit/sandpits/pits.txt"
        exit
      fi
      INSTALLPIT=true
      PITFILE=$OPTARG
      ;;
    s)
      SANDBOXROOT=$OPTARG
      ;;
    v)
      PITDIST=$OPTARG
      ;;
    e)
      ENCRYPT=true
      ;;
    g)
      if [ "$OPTARG" == "list" ]; then
        checkCommand curl
        echo "Getting list of sand grains..."
        curl -sL "https://github.com/cal2195/Sandbox/raw/master/sandgrains/grains.txt"
        exit
      fi
      GRAINS=$OPTARG
      ;;
    o)
      VIEWOVERLAY=true
      ;;
    x)
      XSESSION=true
      ;;
    f)
      XEPHYR="Xephyr -ac -fullscreen :1"
      ;;
    c)
      COMMITCHANGES=true
      ;;
    \?)
      echo "Invalid flag: -$OPTARG" >&2
      usage
      exit
      ;;
    h)
      usage
      exit
      ;;
  esac
done
shift $(($OPTIND - 1))

#Check for Permanent
if [ "$PERMANENT" == true ]; then
  MNTDIR=$SANDBOXROOT
fi

#Check if using pits
if [ "$USINGPIT" == true ]; then
  if [ "$INSTALLPIT" == true ]; then
    installPits
  elif [ ! -d $SANDBOXROOT/$PITDEST/$SANDPIT ]; then
    echo "No sandpit named $NAME exist! Try using -i to install one!"
    exit
  fi
  SYSROOT="$SANDBOXROOT/$PITDEST/$SANDPIT"
fi

#Delete if required
if [ "$DELETENOW" == true ]; then
  if [ "$RAMDISK" == true ]; then
    MNTDIR="/tmp/ram/sandbox"
  fi
  sudo rm -r $MNTDIR/$NAME/rw
  echo "Sandbox deleted!"
  exit
fi

#List sandboxes
if [ "$LISTBOXES" == true ]; then
  echo "Sandboxes:"
  ls $MNTDIR
  exit
fi

#Mount and Use Ram Disk
if [ "$RAMDISK" == true ]; then
  mkdir -p /tmp/ram/sandbox
  sudo mount -t tmpfs tmpfs /tmp/ram/sandbox
  MNTDIR="/tmp/ram/sandbox"
fi

#Check if they want to view files
if [ "$VIEWOVERLAY" == true ]; then
  xdg-open $MNTDIR/$NAME/rt
  exit
fi

#Update NEWDISPLAY
if [ "$XSESSION" == true ]; then
  if [[ "$(tty)" == *"tty"* ]]; then
    NEWDISPLAY=:2
  else
    NEWDISPLAY=:1
  fi
fi

#Install dependencies & sandbox
if [ "$1" == "install" ]; then
  echo "Installing..."
  if [ "$NEEDSDEPS" == true ]; then
    checkCommand unionfs-fuse
  fi
  sudo cp $0 /usr/local/bin/$0
  echo "Installed!"
  exit
elif [ "$1" == "update" ]; then
  checkCommand curl
  echo "Updating..."
  sudo curl -sL -o $0 "https://github.com/cal2195/Sandbox/raw/master/sandbox"
  echo "Update Successful!"
  exit
else
  #Determine sandbox type
  setupSandboxFolders

  if [ "$COMMITCHANGES" == true ]; then
    commitChanges
  fi

  if [ "$ENCRYPT" == true ]; then
    checkCommand encfs
    mkdir -p $tmprw.e
    sudo encfs $tmprw.e $tmprw
  fi

  #Let's get going!
  mountSandbox
  configureSandbox

  #Initialise with any sand grains
  installSandgrains

  #Setup any sandpits
  configurePits

  #Check if xsession
  if [ "$XSESSION" == true ]; then
    startXSession
  else
    #And we're away! :D
    if [ "$#" -eq  "0" ]; then
      sudo chroot $tmprt su - $USER
    else
      sudo chroot $tmprt su - $USER -c "$@"
    fi
  fi
  #Clean up after exit
  if [ "$REMOVEAFTER" == true ]; then
    sudo rm -r $tmprw
    echo "Sandbox deleted!"
  else
    echo "Sandbox not deleted - reattach using the name: $NAME"
  fi
fi