I have this local network service and this client program needing to access it. I am running them both as an unprivileged user.
I am looking for a way to sandbox the client using firejail, in a way that it cannot access network, except for localhost (or even better, except for that service). first thing I tried was of course
firejail --net=lo program
But it didn’t work.
Error: cannot attach to lo device
I think I could work around it by creating a virtual network interface, for example veth0 and veth1, moving veth1 to a new network namespace in which I’d run the service and using firejail to restrain the client to veth0
Is there a way to actually automate this setting in a firejail profile, so that all of these interfaces are created and veth1 is moved when I type
(without having to run anything as root)?
Or is there a simpler way solve this problem? (I cannot run both the client and the service in the same namespace, because the service needs to access the network)