[PATCH v4 4/6] doc/examples: add a Firejail profile for sandboxing filtering programs

Subject: [PATCH v4 4/6] doc/examples: add a Firejail profile for sandboxing filtering programs

Date: Sat, 7 Mar 2026 17:03:40 +0100

To: notmuch@notmuchmail.org

Cc:

From: Anton Khirnov

---
 Makefile.local              | 2 +-
 configure                   | 6 ++++++
 debian/rules                | 1 +
 doc/Makefile.local          | 8 +++++++-
 doc/man1/notmuch-config.rst | 7 +++++++
 5 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/Makefile.local b/Makefile.local
index 2eb0ead8..26c15505 100644
--- a/Makefile.local
+++ b/Makefile.local
@@ -280,7 +280,7 @@ git-remote-notmuch-shared: git-remote-notmuch.o status.o tag-util.o query-string
 	$(call quiet,$(FINAL_NOTMUCH_LINKER) $(CFLAGS)) $^ $(FINAL_NOTMUCH_LDFLAGS) -o $@
 
 .PHONY: install
-install: all install-man install-info
+install: all install-man install-info install-examples
 	mkdir -p "$(DESTDIR)$(prefix)/bin/"
 	install notmuch-shared "$(DESTDIR)$(prefix)/bin/notmuch"
 	install git-remote-notmuch-shared "$(DESTDIR)$(prefix)/bin/git-remote-notmuch"
diff --git a/configure b/configure
index b5634fba..72945332 100755
--- a/configure
+++ b/configure
@@ -178,6 +178,7 @@ Fine tuning of some installation directories is available:
 	--includedir=DIR	Install header files to DIR [PREFIX/include]
 	--mandir=DIR		Install man pages to DIR [PREFIX/share/man]
 	--infodir=DIR		Install man pages to DIR [PREFIX/share/man]
+	--docdir=DIR		Install additional documentation to DIR [PREFIX/share/doc/notmuch]
 	--sysconfdir=DIR	Read-only single-machine data [PREFIX/etc]
 	--emacslispdir=DIR	Emacs code [PREFIX/share/emacs/site-lisp]
 	--emacsetcdir=DIR	Emacs miscellaneous files [PREFIX/share/emacs/site-lisp]
@@ -225,6 +226,8 @@ for option; do
 	MANDIR="${option#*=}"
     elif [ "${option%%=*}" = '--infodir' ] ; then
 	INFODIR="${option#*=}"
+    elif [ "${option%%=*}" = '--docdir' ] ; then
+	DOCDIR="${option#*=}"
     elif [ "${option%%=*}" = '--sysconfdir' ] ; then
 	SYSCONFDIR="${option#*=}"
     elif [ "${option%%=*}" = '--emacslispdir' ] ; then
@@ -1402,6 +1405,9 @@ mandir = ${MANDIR:=\$(prefix)/share/man}
 # The directory to which man pages should be installed
 infodir = ${INFODIR:=\$(prefix)/share/info}
 
+# The directory to which additional documentation should be installed
+docdir = ${DOCDIR:=\$(prefix)/share/doc/notmuch}
+
 # The directory to which read-only (configuration) files should be installed
 sysconfdir = ${SYSCONFDIR:=\$(prefix)/etc}
 
diff --git a/debian/rules b/debian/rules
index 4e0836e7..39234908 100755
--- a/debian/rules
+++ b/debian/rules
@@ -14,6 +14,7 @@ override_dh_auto_configure:
 		--includedir=/usr/include \
 		--mandir=/usr/share/man \
 		--infodir=/usr/share/info \
+		--docdir=/usr/share/doc/notmuch \
 		--sysconfdir=/etc \
 		--zshcompletiondir=/usr/share/zsh/vendor-completions \
 		--localstatedir=/var
diff --git a/doc/Makefile.local b/doc/Makefile.local
index aafa77a0..4edc4b1c 100644
--- a/doc/Makefile.local
+++ b/doc/Makefile.local
@@ -38,9 +38,11 @@ endif
 COPY_INFO1 := $(patsubst $(DOCBUILDDIR)/man/man1/%.1,$(DOCBUILDDIR)/texinfo/%.info,$(COPY_ROFF1))
 INFO_INFO_FILES := $(INFO_TEXI_FILES:.texi=.info) $(COPY_INFO1)
 
+EXAMPLES_FILES := doc/examples/firejail.profile
+
 .PHONY: sphinx-html sphinx-texinfo sphinx-info
 
-.PHONY: install-man build-man apidocs install-apidocs
+.PHONY: install-man build-man apidocs install-apidocs install-examples
 
 %.gz: %
 	rm -f $@ && gzip --no-name --stdout $^ > $@
@@ -156,6 +158,10 @@ $(dir)/config.dox: version.stamp
 	echo "PROJECT_NAME = \"Notmuch $(VERSION)\"" > $@
 	echo "INPUT=${srcdir}/lib/notmuch.h" >> $@
 
+install-examples:
+	mkdir -m0755 -p "$(DESTDIR)$(docdir)/examples"
+	install -m0644 $(EXAMPLES_FILES) $(DESTDIR)$(docdir)/examples
+
 CLEAN := $(CLEAN) $(DOCBUILDDIR) $(DOCBUILDDIR)/.roff.stamp $(DOCBUILDDIR)/.texi.stamp
 CLEAN := $(CLEAN) $(DOCBUILDDIR)/.html.stamp $(DOCBUILDDIR)/.info.stamp
 CLEAN := $(CLEAN) $(MAN_GZIP_FILES) $(MAN_ROFF_FILES) $(dir)/conf.pyc $(dir)/config.dox
diff --git a/doc/man1/notmuch-config.rst b/doc/man1/notmuch-config.rst
index d2f80d19..0418751c 100644
--- a/doc/man1/notmuch-config.rst
+++ b/doc/man1/notmuch-config.rst
@@ -166,6 +166,13 @@ paths are presumed relative to `$HOME` for items in section
    sandboxing mechanism, so that it cannot be subverted to attack your
    system or steal your data.
 
+   Some of the options you may consider are:
+   * Firejail (https://firejail.wordpress.com/ , Linux-specific); a sample
+     Firejail profile is shipped with notmuch documentation (typically installed
+     in ``/usr/share/doc/notmuch``) as ``examples/firejail.profile``. You
+     may use it as ``notmuch config set index.filter 'firejail
+     --profile=<.../examples/firejail.profile> <your filter program>'``.
+
    The filter is a commandline split in a POSIX shell-like manner (without
    actually invoking the shell, so shell expansions are not performed and shell
    constructs are not allowed) and executed. The payload of the MIME part to be
-- 
2.47.3

_______________________________________________
notmuch mailing list -- notmuch@notmuchmail.org
To unsubscribe send an email to notmuch-leave@notmuchmail.org

Thread: