A hacky solution for wrapping firefox in bubblewrap

firefox_bwrap.sh

#!/bin/bash

get_devices () {
    tokens=()

    for i in /dev/hidraw*; do
        udevadm info --query=property --property=ID_SECURITY_TOKEN $i | grep -q "ID_SECURITY_TOKEN" && tokens+=("$i")
    done

    echo "${tokens[@]}"
}

get_path () {
    paths=()
    devpath=$(udevadm info -q path $1)
    paths+=("/sys${devpath}")
    usbsegment=$(echo ${devpath} | perl -ne '$_ =~ m<usb[0-9]+/([^/]+/[^/]+)/>; print "$1";')
    paths+=("/sys/bus/usb/devices/${usbsegment}")
    echo "${paths[@]}"
}

get_args () {
    devices=$(get_devices)
    for i in $devices; do
        echo "--dev-bind $i $i"
        devid=$(echo $i | awk -F/ '{print $3}')
        paths+=($(get_path "$i"))
        paths+=("/sys/class/hidraw/${devid}")
    done
    for i in "${paths[@]}"; do
        echo "--ro-bind $i $i"
    done

}

bwrap \
--ro-bind /lib /lib \
--ro-bind /lib64 /lib64 \
--ro-bind /bin /bin \
--ro-bind /usr/lib /usr/lib \
--ro-bind /usr/lib64 /usr/lib64 \
--ro-bind /usr/bin /usr/bin \
--ro-bind /usr/share/applications /usr/share/applications \
--ro-bind /usr/share/gtk-4.0 /usr/share/gtk-4.0 \
--ro-bind /usr/share/fontconfig /usr/share/fontconfig \
--ro-bind /usr/share/icu /usr/share/icu \
--ro-bind /usr/share/drirc.d /usr/share/drirc.d \
--ro-bind /usr/share/fonts /usr/share/fonts \
--ro-bind /usr/share/glib-2.0 /usr/share/glib-2.0 \
--ro-bind /usr/share/glvnd /usr/share/glvnd \
--ro-bind /usr/share/icons /usr/share/icons \
--ro-bind /usr/share/libdrm /usr/share/libdrm \
--ro-bind /usr/share/mime /usr/share/mime \
--ro-bind /usr/share/X11/xkb /usr/share/X11/xkb \
--ro-bind /usr/share/icons /usr/share/icons \
--ro-bind /usr/share/mime /usr/share/mime \
--ro-bind /etc/fonts /etc/fonts \
--ro-bind /etc/resolv.conf /etc/resolv.conf \
--ro-bind /usr/share/ca-certificates /usr/share/ca-certificates \
--ro-bind /etc/ssl /etc/ssl \
--ro-bind /etc/ca-certificates /etc/ca-certificates \
--dir /run/user/"$(id -u)" \
--ro-bind /run/user/"$(id -u)"/pulse /run/user/"$(id -u)"/pulse \
--ro-bind "/run/user/$(id -u)/pipewire-0" "/run/user/$(id -u)/pipewire-0" \
--ro-bind /run/user/"$(id -u)"/wayland-0 /run/user/"$(id -u)"/wayland-0 \
--dev /dev \
$(get_args) \
--dev-bind /dev/usb/hiddev1 /dev/usb/hiddev1 \
--dev-bind /dev/dri /dev/dri \
--ro-bind /sys/dev/char /sys/dev/char \
--ro-bind /sys/devices/pci0000:00 /sys/devices/pci0000:00 \
--proc /proc \
--tmpfs /tmp \
--bind /home/hlieberman/.firefox /home/hlieberman/.firefox \
--bind /home/hlieberman/.mozilla /home/hlieberman/.mozilla \
--bind /home/hlieberman/Downloads /home/hlieberman/Downloads \
--setenv HOME /home/hlieberman \
--setenv GTK_THEME Adwaita \
--setenv MOZ_ENABLE_WAYLAND 1 \
--setenv PATH /usr/bin \
--hostname aztlan \
--unshare-all \
--share-net \
--die-with-parent \
--new-session \
/home/hlieberman/.firefox/firefox