TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Firejail: Linux namespaces and seccomp-bpf sandbox

154 点作者 varbhat大约 3 年前

8 条评论

throwaway82652大约 3 年前
My main issue with Firejail is that it still uses a SUID binary, compared to bwrap which has supported rootless operation for a while now. If you have to use SUID I think it&#x27;s no better than using the same functionality in Docker or systemd, which are probably already on your system if you&#x27;re a developer. Though I would love to hear if anyone has any other use cases where firejail really shines compared to the other similar tools to manage namespaces and seccomp.<p>It might eventually be possible to relax this restriction and get rid of the SUID but I expect they would have to really clean up the kernel API, and that takes priority over fixing the userspace sandbox.
评论 #30821054 未加载
评论 #30823406 未加载
评论 #30821159 未加载
评论 #30821752 未加载
评论 #30820860 未加载
评论 #30822945 未加载
评论 #30821707 未加载
makeworld大约 3 年前
Happily using this for Zoom, I don&#x27;t trust their security.
评论 #30820823 未加载
mwcampbell大约 3 年前
I wonder how practical it is to use a VM per application instead. Of course, Qubes has already done this, but it uses Xen. What would be the minimum practical overhead per VM, when each VM needs to run a single-application GUI stack?
评论 #30829438 未加载
asicsp大约 3 年前
Previous discussion: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=25052341" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=25052341</a> <i>(214 points | Nov 10, 2020 | 48 comments)</i>
staticassertion大约 3 年前
I hope eventually, with systems like landlock making sandboxing a bit more accessible, developers just start sandboxing their software by default. 3rd parties maintaining policies is less than ideal.
评论 #30821072 未加载
评论 #30823278 未加载
评论 #30829451 未加载
danShumway大约 3 年前
Also consider Bubblewrap, which is what Flatpak uses under the hood. There are a couple of meaningful differences which may or may not be important to you: <a href="https:&#x2F;&#x2F;github.com&#x2F;containers&#x2F;bubblewrap#related-project-comparison-firejail" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;containers&#x2F;bubblewrap#related-project-com...</a><p>Personally, I like that Bubblewrap doesn&#x27;t require the same level of privileging, and I like the consistency with Flatpak. It feels like an unnecessary increase in attack surface to be running completely separate sandboxing tools. But, there are also advantages to Firejail, I&#x27;m not saying you shouldn&#x27;t use it.<p>Reminder that unless you&#x27;re doing complicated things with X sessions, Wayland is an important part of sandboxing and you should probably assume that any graphical malware will be able to break out of a sandbox on an X system (not because it&#x27;s <i>impossible</i> to sandbox X, just that if you&#x27;re dabbling in this stuff you&#x27;re probably not sandboxing it correctly). Honestly, you should probably use something more robust than either of these programs if you&#x27;re worried about malware. I just think it&#x27;s easier and safer to use a VM and importantly I think you&#x27;re less likely to shoot yourself in the foot using a VM (although it is still possible for malware to escape VMs depending on how they&#x27;re configured). I&#x27;m not a security expert, take that advice with many grains of salt.<p>----<p>A lot of these programs (in my opinion) lack really good documentation about how to work with them. You kind of need to know the basics of how they work before you start. I think if anyone ever wanted to create a really detailed guide about what the different options are, what the considerations are, stuff like that, there&#x27;s a lot of opportunity there to single-handedly drastically improve the accessibility of these tools. Most guides I have seen assume you know already know how the underlying permissions, process isolation, network stuff all works -- even some of the better guides on Arch (<a href="https:&#x2F;&#x2F;wiki.archlinux.org&#x2F;title&#x2F;Firejail" rel="nofollow">https:&#x2F;&#x2F;wiki.archlinux.org&#x2F;title&#x2F;Firejail</a>, <a href="https:&#x2F;&#x2F;wiki.archlinux.org&#x2F;title&#x2F;bubblewrap" rel="nofollow">https:&#x2F;&#x2F;wiki.archlinux.org&#x2F;title&#x2F;bubblewrap</a>) are just not accessible unless you&#x27;re willing to go down those rabbit holes and figure out all of the terminology being used.<p>It&#x27;s not that the documentation doesn&#x27;t exist, and once you understand how the command line options work they&#x27;re kind of nice, but all of the documentation is kind of spread around and hard to find and there&#x27;s a lot of pulling up manpages and looking up words that get dropped with no context -- if you happen to know Linux security even just reasonably well and you&#x27;re ever looking around for an unmet need or niche that&#x27;s possible for one person to solve on their own, then this is the kind of problem that could be fixed with like one in-depth blogpost series.<p>There&#x27;s just a real need for more tutorials about this stuff that can be shared with people who want to do manual configuration or command line usage, but that don&#x27;t necessarily have the background required to just jump into the Arch docs. I&#x27;ve thought about trying to make one, but I am very nervous about giving people bad advice since I&#x27;m mostly self-taught on a lot of the security stuff.<p>I haven&#x27;t checked back though since I started using Bubblewrap, so also maybe I&#x27;m out of date and there&#x27;s more documentation today.
评论 #30821769 未加载
jchw大约 3 年前
I’m using Firejail as an additional layer of defense on some machines.<p>It’s not a silver bullet, and I get the feeling that the jails for Firefox&#x2F;Chromium are not terribly constraining.<p>I also don’t think there’s a good way to poke holes for things like libnotify or links in browsers that go to native applications. This is a shame; I’d love the ability to have a link from Firefox under Firejail to poke out and run in Zoom or Slack under their respective sandboxes, or just to get native notification boxes.<p>Still, I think practically it does a lot to limit the blast radius of potential attacks, especially if you don’t expect to be explicitly targeted.
egberts1大约 3 年前
Better off using ipfilter or nftable namespace filtering.