run-ventoy2disk.sh

gistfile1.txt

!/usr/bin/env bash

# by codex 5.6

set -euo pipefail

# Ventoy cannot unmount filesystems in the host mount namespace from inside
# bubblewrap.  Unmount the target partitions before entering the sandbox so
# the kernel can reread the partition table after Ventoy rewrites it.
for partition in /dev/sda1 /dev/sda2; do
  if findmnt --noheadings --source "$partition" >/dev/null; then
    sudo umount "$partition"
  fi
done

sudo systemd-run --quiet --pty --wait --collect \
  -p Type=exec \
  -p DevicePolicy=closed \
  -p 'DeviceAllow=/dev/sda rwm' \
  -p 'DeviceAllow=/dev/sda1 rwm' \
  -p 'DeviceAllow=/dev/sda2 rwm' \
  -p PrivateNetwork=yes \
  -p ProtectKernelTunables=yes \
  -p ProtectKernelModules=yes \
  -p ProtectKernelLogs=yes \
  -p ProtectControlGroups=yes \
  -p NoNewPrivileges=yes \
  -p RestrictSUIDSGID=yes \
  -p 'CapabilityBoundingSet=CAP_SYS_ADMIN CAP_MKNOD CAP_DAC_OVERRIDE CAP_FOWNER CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_SYS_CHROOT' \
  /usr/bin/bwrap \
    --die-with-parent \
    --unshare-pid \
    --unshare-ipc \
    --unshare-uts \
    --clearenv \
    --setenv PATH /usr/sbin:/usr/bin:/sbin:/bin \
    --setenv HOME /tmp \
    --setenv LANG C \
    --ro-bind /usr /usr \
    --symlink usr/bin /bin \
    --symlink usr/sbin /sbin \
    --symlink usr/lib /lib \
    --symlink usr/lib64 /lib64 \
    --dir /etc \
    --ro-bind-try /etc/ld.so.cache /etc/ld.so.cache \
    --ro-bind-try /etc/localtime /etc/localtime \
    --symlink /proc/mounts /etc/mtab \
    --proc /proc \
    --ro-bind /sys /sys \
    --dev /dev \
    --dev-bind /dev/sda /dev/sda \
    --dev-bind /dev/sda1 /dev/sda1 \
    --dev-bind /dev/sda2 /dev/sda2 \
    --tmpfs /tmp \
    --dir /run \
    --bind "$PWD" /work \
    --chdir /work \
    /bin/bash ./Ventoy2Disk.sh -i /dev/sda