I noticed a worrying behavior when Lutris (Wine) creates a prefix on my system.
What I see
Drive W: mounted as /mnt — this contains all my drives with all my personal data.
Drive X: mounted as ~/home.
Drive Z: mounted as / (the root drive) — I understand Z is a Wine default
Questions
Why does Lutris create W and X in addition to the default Z? Mounting /mnt and ~/home into the prefix exposes my entire file system to programs running in Wine.
Is there a way to prevent Lutris from exposing these paths to the prefix?
Can a Wine prefix be isolated (sandboxed) so that it does not have access to my home directory or other host mounts? If so, what’s the recommended approach or configuration?
Thanks in advance for any explanations or recommendations.
If you go to the directory associated with your wine prefix (eg. ~/Games/prefix-name), there will be a subdirectory named “dosdevices” and in that subdirectory there are symbolic links for drives and other stuff. You can delete or relocate these links as you please. This is also useful if you need to have a CD/DVD/ISO associated with a specific drive letter every time a game/app is launched.
Personally, I’m using firejail to do access control for Lutris and any subprocess (wine) started by Lutris. By doing so, I can define which directories/drives Lutris should have access to and wheter that access should be read-only or read-write which is great!
I was trying to delete them. But Lutris recreates them every app run. Edit mount folder also didn’t help. Probably I can use pre run script which deletes them?
Instead of deleting them, try to point them to something “safe”: ln -sfr ~/SafeDir ~/Games/wine-prefix/dosdevices/W:.
If you select the app/game in Lutris and click the little “up-arrow” next to the wine glass in the bottom of Lutris, and then select “Wine configuration” from the menu, you will have a tab named “Devices” (or alike) on which you also can modify the devices.
I do not think this is done by Lutris, but by Wine. The only sollution I can come up with is to use some sort of sandboxing like Firejail, BubbleWrap, AppArmor or alike to disallow Lutris and any child processes (Wine) from accessing your private files.