X-Envelope-From: notmuch-bounces@notmuchmail.org Sat Aug 15 14:12:15 2026 Return-Path: X-Original-To: nmbug@yantan.tethera.net Delivered-To: nmbug@yantan.tethera.net Received: from yantan.tethera.net (localhost [127.0.0.1]) by mail.notmuchmail.org (Postfix) with ESMTP id 12C505F8A5; Sat, 15 Aug 2026 14:12:15 +0000 (UTC) Received: from mail1.khirnov.net (mail1.khirnov.net [IPv6:2a00:c500:561:206::5]) by mail.notmuchmail.org (Postfix) with ESMTPS id 685B85F896 for ; Sat, 15 Aug 2026 14:12:07 +0000 (UTC) Authentication-Results: mail1.khirnov.net; dkim=pass (2048-bit key; unprotected) header.d=khirnov.net header.i=@khirnov.net header.a=rsa-sha256 header.s=mail header.b=QFqV8qu2; dkim-atps=neutral Received: from localhost (mail1.khirnov.net [IPv6:::1]) by mail1.khirnov.net (Postfix) with ESMTP id 702FD1FA3 for ; Sat, 15 Aug 2026 16:02:48 +0200 (CEST) Received: from mail1.khirnov.net ([IPv6:::1]) by localhost (mail1.khirnov.net [IPv6:::1]) (amavis, port 10024) with ESMTP id AhpwhkKJg6YG for ; Sat, 15 Aug 2026 16:02:48 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=khirnov.net; s=mail; t=1786802563; bh=txw1PQPcP/eQxhRtgMX2zIE38a1hKp+gvxlhs1/V4zw=; h=From:To:Subject:Date:In-Reply-To:References:From; b=QFqV8qu2R64WWCa3EC+TIQhjOnbuQhtPcOr72Mu0hEp2L334BVkAipU/9RJYINdsW PPFDeaNt5wGUuJcxUib5S2eUXmUCe+DqfWvPeZOTzfnKNyTyDlimp3TeUTqzLN4mx8 K+O/IUqZQqZDP5HzDaCbAxf/q+gb7EOyDjbVGV84JJO5k1m6TgNS2WIcNUuIFikFj0 Xx4QZASI6y39IG9R7kJ3NhUktJ+bY0FhusoibOw12ZbHo2pWrMxsNW4HH3UhIDqosB 7MsOnXZU8NBXLCZx4VuO8J80YWGKtU6WliVKSMbJ6hg/b03MQnFzAL0OC7a2uQvXnJ tvgKYxhe1kStA== Received: from dev0.khirnov.net (dev0.khirnov.net [IPv6:2a00:c500:561:201::6]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "dev0.khirnov.net", Issuer "smtp.khirnov.net SMTP CA" (verified OK)) by mail1.khirnov.net (Postfix) with ESMTPS id E277F1FF9 for ; Sat, 15 Aug 2026 16:02:42 +0200 (CEST) Received: by dev0.khirnov.net (Postfix, from userid 1000) id 9567A402B9C; Sat, 15 Aug 2026 16:02:40 +0200 (CEST) From: Anton Khirnov To: notmuch@notmuchmail.org Subject: [PATCH v5 5/6] doc/examples: add an example Bubblewrap command for sandboxing filtering programs Date: Sat, 15 Aug 2026 16:01:27 +0200 Message-ID: <20260815140127.26199-7-anton@khirnov.net> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260815140127.26199-2-anton@khirnov.net> References: <20260815140127.26199-2-anton@khirnov.net> MIME-Version: 1.0 Message-ID-Hash: ABZWUPP27Y2ZZFBXBCKRJ4AW7THGKV5C X-Message-ID-Hash: ABZWUPP27Y2ZZFBXBCKRJ4AW7THGKV5C X-MailFrom: anton@khirnov.net X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-notmuch.notmuchmail.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.3 Precedence: list List-Id: "Use and development of the notmuch mail system." List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit --- doc/Makefile.local | 2 ++ doc/examples/bwrap.sh | 9 +++++++++ doc/man1/notmuch-config.rst | 4 ++++ 3 files changed, 15 insertions(+) create mode 100755 doc/examples/bwrap.sh diff --git a/doc/Makefile.local b/doc/Makefile.local index 4edc4b1c..64e51475 100644 --- a/doc/Makefile.local +++ b/doc/Makefile.local @@ -39,6 +39,7 @@ COPY_INFO1 := $(patsubst $(DOCBUILDDIR)/man/man1/%.1,$(DOCBUILDDIR)/texinfo/%.in INFO_INFO_FILES := $(INFO_TEXI_FILES:.texi=.info) $(COPY_INFO1) EXAMPLES_FILES := doc/examples/firejail.profile +EXAMPLES_FILES_EXEC := doc/examples/bwrap.sh .PHONY: sphinx-html sphinx-texinfo sphinx-info @@ -161,6 +162,7 @@ $(dir)/config.dox: version.stamp install-examples: mkdir -m0755 -p "$(DESTDIR)$(docdir)/examples" install -m0644 $(EXAMPLES_FILES) $(DESTDIR)$(docdir)/examples + install -m0755 $(EXAMPLES_FILES_EXEC) $(DESTDIR)$(docdir)/examples CLEAN := $(CLEAN) $(DOCBUILDDIR) $(DOCBUILDDIR)/.roff.stamp $(DOCBUILDDIR)/.texi.stamp CLEAN := $(CLEAN) $(DOCBUILDDIR)/.html.stamp $(DOCBUILDDIR)/.info.stamp diff --git a/doc/examples/bwrap.sh b/doc/examples/bwrap.sh new file mode 100755 index 00000000..04f20fb7 --- /dev/null +++ b/doc/examples/bwrap.sh @@ -0,0 +1,9 @@ +#!/bin/sh + +# 100MB for /tmp and ~/.cache tmpfs mounts +TMPSIZE=$((100*1024*1024)) + +bwrap \ + --ro-bind / / \ + --size "$TMPSIZE" --tmpfs /tmp --size "$TMPSIZE" --tmpfs $HOME/.cache \ + --dev /dev --unshare-all --new-session -- "$@" diff --git a/doc/man1/notmuch-config.rst b/doc/man1/notmuch-config.rst index 6c972d27..29f8f77e 100644 --- a/doc/man1/notmuch-config.rst +++ b/doc/man1/notmuch-config.rst @@ -173,6 +173,10 @@ paths are presumed relative to `$HOME` for items in section in ``/usr/share/doc/notmuch``) as ``examples/firejail.profile``. You may use it as ``notmuch config set index.filter 'firejail --profile=<.../examples/firejail.profile> '``. + * Bubblewrap (https://github.com/containers/bubblewrap , Linux-specific); a + sample Bubblewrap invocation is shipped with notmuch documentation as + ``examples/bwrap.sh``. You may use it as ``notmuch config set index.filter + '.../examples/bwrap.sh '``. The filter is a commandline split in a POSIX shell-like manner (without actually invoking the shell, so shell expansions are not performed and shell -- 2.47.3 _______________________________________________ notmuch mailing list -- notmuch@notmuchmail.org To unsubscribe send an email to notmuch-leave@notmuchmail.org