Questions tagged [firejail]
The firejail tag has no usage guidance.
39
questions
0
votes
0
answers
19
views
Which wins? `--net=none` versus profile with networking enabled
Firejail has a option where you can disable networking with a command like this:
firejail --net=none ping 9.9.9.9
--net=none prevents ping for succeeding.
Firejail also has an option to specify a ...
- 4,369
2
votes
0
answers
50
views
How to run a child process inside firejail sandbox?
Hello Linux folks i need help running with firejail with a java program that is in sandbox
firejail --private --trace java -jar program.jar
But this program can't spawn child process (chromium) due to ...
- 43
0
votes
0
answers
84
views
block internet access to all applications except whitelisted
If blacklisting I'd use firejail, but since I want to whitelist and include preinstalled binaries, seems like SEL is the only potential choice. Essentially, could SEL be used to add a new type context ...
- 13
1
vote
1
answer
349
views
Firejail not hiding files with Brave browser
If I run the following:
firejail brave-browser
And then try and access files in the browser (such as when uploading a file), Brave still has access to my entire home folder.
Usually this doesn't ...
- 133
3
votes
0
answers
77
views
Firejail not hiding files with Brave browser
If I run the following:
firejail brave-browser
And then try and access files in the browser (such as when uploading a file), Brave still has access to my entire home folder.
Usually this doesn't ...
- 133
2
votes
1
answer
367
views
Firejail overlay permissions and ALSA no sound (wrong group in container/jail)
I'll try to be brief and concise. I want to run programs that require ALSA with firejail profiles but it probably doesn't have the permission or ability to access the soundcard for some reason ...
- 23
0
votes
1
answer
483
views
Allow to run Telegram (or any other application) via firejail, prevent it from running directly
Preferably without using sudo.
So far I've just saved it under /opt/telegram/Telegram without adding it to $PATH but that's not a solution since I can easily run it accidentally.
- 20.6k
0
votes
1
answer
741
views
How to run external executables within firejail
My machine is home desktop(personal) running Debian Buster with i3 window manager. I recently installed firejail with apt install firejail* firetools and also downloaded the new Firefox 83 browser ...
- 246
0
votes
1
answer
185
views
Error when excecuting firejail from zathura: cannot create /run/firejail/profile/14844
In zathura, I use :exec firejail firefox to start firefox with firejail. There is an error "cannot create /run/firejail/profile/14844" and firefox does not start. When I type firejail ...
1
vote
1
answer
380
views
create custom profile to run man using firejail
I'm trying to use firejail (version 0.9.58.2) for application sandboxing on my Debian Stable machine. From what I understand it's possible to create a custom configuration file for each application ...
- 338
0
votes
1
answer
195
views
Can't click button of firefox when I run it within firejail + xephyr
I run firefox with the following command:
firejail --x11=xephy firefox
The command usually opens a firefox window (800x600) that fills the xephyr window (800x600). In this case, the following ...
- 49
1
vote
1
answer
409
views
firejail: wine regedit doesn't save changes
Update2:
Registry's changes actually saved. But for entries that will not be permanently stored (that be reset if, for example run wineboot), after regedit (with firejail) is closed, those entries are ...
- 73
1
vote
2
answers
2k
views
Whitelist a directory for execution with firejail
How can I whitelist a directory for execution with firejail?
In particular, I would like to execute Firefox Nightly in firejail. But I get the following error:
$ firejail --profile=/etc/firejail/...
- 11.3k
3
votes
1
answer
317
views
Port forwarding with iptables and firejail sandbox
I try to run a HTTP server on port 8000 in a firejail sandbox, and make it accessible on all interfaces of the host on port 8888.
The whole system can be represented as below:
+----------------------...
- 51
1
vote
1
answer
335
views
Disable --noprofile in Firejail
How can I disable the --noprofile option in Firejail? For example, is it possible to disable the use of this option in firejail.config so that no one can use it.
- 465
1
vote
0
answers
347
views
Netfilter bypass through Firejail
For isolation, I run Firefox through Xephyr with Openbox. In the Firejail profile, I set net enp2a1 to isolate the network through network namespaces. But I don’t like that a regular user can override ...
- 465
5
votes
0
answers
408
views
Opening /proc/<pid>/net/dev prevents network namespace from expiring, is this expected?
I'm looking for input whether the following observation related to network namespace expiration is expected, or should be reported as bug?
When some process opens /proc/<pid>/net/dev it can ...
- 51
0
votes
2
answers
792
views
Problems with sound in firejail
I am using Parabola (based on Arch) and I would like to use firejail to sandbox one or two less trusted applications (steam, in particular). However, when running applications in firejail (even with ...
- 2,174
1
vote
1
answer
253
views
How to exclude/hide a directory from a command (find command or else)?
How to exclude a folder or path from a command or application in general?
I am trying to exclude a path from find command but available possibilities like prune option explained here and here makes ...
- 12.9k
1
vote
1
answer
448
views
Firejail not working over socks5 SSH tunnel
I have an Ubuntu 18.04 server in which I've created two virtual interface pairs (veth0a & veth0b) and assigned the end of one interface (veth0b) to a new network namespace (netns0):
ip netns add ...
- 35
1
vote
1
answer
2k
views
Sandboxing Firefox using firejail: Download directory
I have been using firejail for sandboxing my application in Ubuntu. It has a --private option. I was using
firejail --private=/home/user/Desktop firefox
When I try to download a file from Firefox ...
- 33
0
votes
0
answers
56
views
Sandboxing in ubuntu
I want to run some of my programs like skype,firefox,office suite in side seperate VMS..in Linux..Is it possible to install only an application inside a vm without installing the whole os..also i dont ...
- 33
0
votes
1
answer
2k
views
How to use KeePassXC with Firefox and firejail
I am looking at KeePassXC on my Linux Mint Cinnamon system. The installation and initial usage all went well, following the built-in tutorial; but there is a problem with Firefox integration.
After ...
- 265
1
vote
0
answers
569
views
Sudenly, firefox is not opening at Parrot OS
I was using few times Parrot OS live booted from RAM or USB as well. Firefox is the web browser built in and my favourite by the way, so I used it.
Unfortunatelly is not working properly anymore. I ...
- 21
0
votes
1
answer
168
views
Firejailed Thunderbird, opening attachments
I am running both Firefox and Thunderbird in firejail, on Linux Mint 19.1.
By coincidence, two people recently sent me emails with attached PDFs, but they were handled differently. The emails came ...
- 265
0
votes
2
answers
298
views
Does firejail rely on the application crashing out and why can't we use named pipes to .Xauthority?
The purpose of jailing an Xorg application is to prevent it from accessing @/tmp/X11/X0 and /tmp/X11/X0 and then re-using its MIT-MAGIC-COOKIE to steal from other apps that are connected to the X ...
- 1
3
votes
1
answer
2k
views
firejail : only let a program access localhost
I have this local network service and this client program needing to access it. I am running them both as an unprivileged user.
I am looking for a way to sandbox the client using firejail, in a way ...
- 916
3
votes
0
answers
272
views
firejail: child-process not sandboxed?
As far as the sandbox "firejail" is concerned I´ve encountered a phenomenon which isn´t completely clear to me.
My understanding has always been that whenever I start a programm/process in firejail ...
- 141
1
vote
1
answer
1k
views
How to avoid running make as root in the last step of installing an application from source? [duplicate]
I am always reluctant to run make install as root as the last step of installing an application from source. After all, it allows executing arbitrary code form the Makefile. It has already happened to ...
- 440
2
votes
1
answer
2k
views
firejail memory limit
I want to create a firejail profile that limits memory for applications.
I'm trying to figure out if it's possible to limit memory using firejail.
But It seems that some versions had the --rlimit-as ...
- 145
-1
votes
1
answer
656
views
firejail for complete security (for scripts downloaded from Inet)
I need to run scripts downloaded from the untrusted network.
I want to run such scripts in Firejail.
But firejail --caps.drop=all ls /home/porton/ shows that it has access to my home directory! It ...
- 2,046
1
vote
0
answers
138
views
How to install firetools in whonix?
My goal to launch browser safety, for this task I need use firejail (exists in backports repository) and firetools (not exists in main and in backports).
Are there any ways install firetools on ...
- 13
0
votes
1
answer
438
views
firejail opera browser with --private-option
I´ve created a portable version of the opera-browser (see https://gist.github.com/ruario/8416e36372f1a976a713 ).
In order to open it I've got to type the command opera-developer_27.0.1670.0_amd64/...
- 141
0
votes
1
answer
1k
views
Debian - cannot delete /etc/group- -- "Device or resource busy"
I can't remove /etc/group- -- why not?
root@dom:/etc# whoami
root
root@dom:/etc# pwd
/etc
root@dom:/etc# rm -f /etc/group-
rm: cannot remove ‘/etc/group-’: Device or resource busy
root@dom:/etc# ...
- 111
5
votes
2
answers
3k
views
How can I run local applications through firejail?
I've installed debian package locally. I randomly chose Opera, extracted via dkpg -x opera-x.y.z.deb ~/bin/opera_package, and created a symlink in my user's ~/bin folder (which is in the user's path). ...
- 101
1
vote
1
answer
1k
views
Firejail or chroot [closed]
What's the difference between Firejail and chroot in case of security? I mean, should I trust a built-in tool or third-party for sandboxing untrusted applications that could be potentially targeted to ...
- 163
0
votes
1
answer
2k
views
Firejail and connecting to the Internet through an host OpenVPN client
If the host is an OpenVPN client, how would I set up Internet access for a
firejail sandbox with its own network namespace?
- 111
0
votes
1
answer
1k
views
How to run firejail as root?
How can I run firejail as a root user?
# firejail --seccomp firefox
Reading profile /etc/firejail/firefox.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/...
- 2,513
3
votes
1
answer
320
views
How to use screen when /dev/tty is disabled?
Firejail provides secure environment that strips /dev files with little number of exception. So when I try to run screen inside the environment, I get "Must be connected to a terminal". tty responds ...
- 347