What are the best ways to run a game on sandboxed mode with only game HDD shared to it. There should not be network access for the game and there should be GPU (intel integrated) pass-through.

I have tried Gnome boxes, but GPU pass through is not working and checked distrobox, but that too shares HOME folder.

  • Leaflet@lemmy.worldEnglish
    12·
    6 hours ago

    You can do this using Lutris.

    1. Install it from Flathub
    2. Open Lutris and have it install the tools it needs (wine, dxvk, etc)
    3. Close Lutris
    4. Use Flatseal to limit its permissions; remove network, filesystem access, etc
    5. Open Lutris and run the game

    Note that this isn’t a perfect sandbox. For example, the game can still send a link to your browser to open. Theoretically it could do something malicious with that. Though you could probably work around that issue by changing your default browser to a flatpak version and disable network access there. There might be other small sandbox breaks, but nothing I can think of.

      • Badabinski@kbin.earth
        1·
        51 minutes ago

        Oof, I didn’t know that about firejail. I’d heard of it, but I’d never used it. Like, c’mon folks! If you need privilege escalation, either require launching as root (if appropriate), or delegate the responsibility to a small, well-audited tool designed explicitly for the purpose and spawn a new privileged pid. Don’t use SUID. You will fuck it up. If you reach the point where setuid is your only option, then you’ve hopefully learned enough to rearchitect to not need it, or to give up, or use it if you’re, say, someone who maintains a libc or something.

        EDIT: this is overly dramatic, but also it’s not. I personally feel like using SUID is kinda like rolling your own crypto in terms of required competence.

    • bruce965@lemmy.ml
      8·
      7 hours ago

      Keep in mind that non-hardenized containers only protect you from bugs, they don’t protect you from sophisticated malware. If you suspect the software you are trying to run might be a virus, don’t run it, or run it in a virtual machine.

      I would recommend using containers only if you absolutely understand how to make them secure AND you have no reason to suspect the software you are running might contain nefarious code. In any other case use a virtual machine.

      • Washhouse0749English
        1·
        7 hours ago

        true enough, video acceleration is a bit harder / more expensive with an extra gpu, thats why i shyed away from suggesting vms

        • bruce965@lemmy.ml
          1·
          2 hours ago

          Yeah, I realize that and that’s a nuisance for a videogame… If the game is small enough, OP might be able to give it a virtual GPU with VirtualBox, I did it in the past to play with friends on a single computer. I don’t know if the usual KVM-based VMs support it as well.