# imv and mpv, in a sandbox (`extras/media.sh`)

## SYNOPSIS

```
wrenctl install media                     install them
wrenctl remove media                      remove them
wrenctl manual media                      print the manual steps below

imv photo.jpg | imv ~/Pictures | imv -r ~/Pictures | imv -t 5 ~/Pictures (slideshow)
  Left/Right previous/next   i/o zoom   a actual size   f fullscreen   q quit
mpv video.mp4 | mpv ~/Music | mpv --shuffle ~/Music | mpv --no-video song.mp3
mpv --sub-file=subs.srt movie.mp4   a subtitle file is only seen when you name it
  Space pause   Left/Right 5 s   Up/Down 1 minute   9/0 volume   m mute   f fullscreen   q quit
WREN_NO_SANDBOX=1 mpv video.mp4  without the sandbox
```

imv shows images and mpv plays video and music, both from Debian and both
native on Wayland. Images and videos are where attackers hide things, so the
`imv` and `mpv` commands Wren Linux installs (`bin/imv`, `bin/mpv`) start them
inside bubblewrap (`bin/media-sandbox`): each sees only the files and folders
you name, read-only, its own empty home, no network (except mpv for a URL),
and a restricted Wayland socket (`bin/wayland-restrict`) without sway's
screen-reading or typing protocols. mpv also gets your sound. The first time
mpv starts with no sound set up, it says so once.

## LIMITS

- `/usr/bin/mpv` or `/usr/bin/imv`, or a launcher that uses those paths, skips the sandbox; so does `WREN_NO_SANDBOX=1`.
- The sandbox shares your kernel: a kernel bug could still get out.
- mpv given a URL has the network, so the site sees your address.

## MANUAL INSTALL

```
# imv, mpv, bubblewrap for the sandbox, python3 for wayland-restrict
sudo apt install --no-install-recommends imv mpv bubblewrap python3
# The restricted Wayland socket, the sandbox, and the commands that use it
for c in wayland-restrict media-sandbox imv mpv; do install -D -m 0755 @WREN_DIR@/bin/$c ~/.local/bin/$c; done
# With a web address, the sandbox keeps the program off X11 with this wrapper
sudo install -d -o root -g root -m 0755 /usr/local/libexec
sudo install -o root -g root -m 0755 @WREN_DIR@/bin/no-abstract-sockets /usr/local/libexec/wren-no-abstract-sockets
# ~/.local/bin must come before /usr/bin, so "mpv" is the sandboxed one:
# this must print ~/.local/bin/mpv
command -v mpv
```

To undo:

```
# The commands
rm ~/.local/bin/imv ~/.local/bin/mpv
# Only if neither the PDF viewer nor incognito uses them: the sandbox and the socket
rm ~/.local/bin/media-sandbox ~/.local/bin/wayland-restrict
# (the no-abstract-sockets wrapper only if no other sandbox uses it)
sudo rm /usr/local/libexec/wren-no-abstract-sockets
# imv and mpv; bubblewrap is marked "automatic" instead of purged, since other
# programs can need it: autoremove takes it out only if nothing does
sudo apt purge imv mpv
sudo apt-mark auto bubblewrap
sudo apt autoremove --purge
```