Questions tagged [firejail]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
19 views

Which wins? `--net=none` versus profile with networking enabled

Firejail has a option where you can disable networking with a command like this: firejail --net=none ping 9.9.9.9 --net=none prevents ping for succeeding. Firejail also has an option to specify a ...
user avatar
  • 4,369
2 votes
0 answers
50 views

How to run a child process inside firejail sandbox?

Hello Linux folks i need help running with firejail with a java program that is in sandbox firejail --private --trace java -jar program.jar But this program can't spawn child process (chromium) due to ...
user avatar
  • 43
0 votes
0 answers
84 views

block internet access to all applications except whitelisted

If blacklisting I'd use firejail, but since I want to whitelist and include preinstalled binaries, seems like SEL is the only potential choice. Essentially, could SEL be used to add a new type context ...
user avatar
  • 13
1 vote
1 answer
349 views

Firejail not hiding files with Brave browser

If I run the following: firejail brave-browser And then try and access files in the browser (such as when uploading a file), Brave still has access to my entire home folder. Usually this doesn't ...
user avatar
  • 133
3 votes
0 answers
77 views

Firejail not hiding files with Brave browser

If I run the following: firejail brave-browser And then try and access files in the browser (such as when uploading a file), Brave still has access to my entire home folder. Usually this doesn't ...
user avatar
  • 133
2 votes
1 answer
367 views

Firejail overlay permissions and ALSA no sound (wrong group in container/jail)

I'll try to be brief and concise. I want to run programs that require ALSA with firejail profiles but it probably doesn't have the permission or ability to access the soundcard for some reason ...
user avatar
0 votes
1 answer
483 views

Allow to run Telegram (or any other application) via firejail, prevent it from running directly

Preferably without using sudo. So far I've just saved it under /opt/telegram/Telegram without adding it to $PATH but that's not a solution since I can easily run it accidentally.
user avatar
0 votes
1 answer
741 views

How to run external executables within firejail

My machine is home desktop(personal) running Debian Buster with i3 window manager. I recently installed firejail with apt install firejail* firetools and also downloaded the new Firefox 83 browser ...
user avatar
  • 246
0 votes
1 answer
185 views

Error when excecuting firejail from zathura: cannot create /run/firejail/profile/14844

In zathura, I use :exec firejail firefox to start firefox with firejail. There is an error "cannot create /run/firejail/profile/14844" and firefox does not start. When I type firejail ...
user avatar
1 vote
1 answer
380 views

create custom profile to run man using firejail

I'm trying to use firejail (version 0.9.58.2) for application sandboxing on my Debian Stable machine. From what I understand it's possible to create a custom configuration file for each application ...
user avatar
  • 338
0 votes
1 answer
195 views

Can't click button of firefox when I run it within firejail + xephyr

I run firefox with the following command: firejail --x11=xephy firefox The command usually opens a firefox window (800x600) that fills the xephyr window (800x600). In this case, the following ...
user avatar
  • 49
1 vote
1 answer
409 views

firejail: wine regedit doesn't save changes

Update2: Registry's changes actually saved. But for entries that will not be permanently stored (that be reset if, for example run wineboot), after regedit (with firejail) is closed, those entries are ...
user avatar
  • 73
1 vote
2 answers
2k views

Whitelist a directory for execution with firejail

How can I whitelist a directory for execution with firejail? In particular, I would like to execute Firefox Nightly in firejail. But I get the following error: $ firejail --profile=/etc/firejail/...
user avatar
  • 11.3k
3 votes
1 answer
317 views

Port forwarding with iptables and firejail sandbox

I try to run a HTTP server on port 8000 in a firejail sandbox, and make it accessible on all interfaces of the host on port 8888. The whole system can be represented as below: +----------------------...
user avatar
  • 51
1 vote
1 answer
335 views

Disable --noprofile in Firejail

How can I disable the --noprofile option in Firejail? For example, is it possible to disable the use of this option in firejail.config so that no one can use it.
user avatar
  • 465
1 vote
0 answers
347 views

Netfilter bypass through Firejail

For isolation, I run Firefox through Xephyr with Openbox. In the Firejail profile, I set net enp2a1 to isolate the network through network namespaces. But I don’t like that a regular user can override ...
user avatar
  • 465
5 votes
0 answers
408 views

Opening /proc/<pid>/net/dev prevents network namespace from expiring, is this expected?

I'm looking for input whether the following observation related to network namespace expiration is expected, or should be reported as bug? When some process opens /proc/<pid>/net/dev it can ...
user avatar
0 votes
2 answers
792 views

Problems with sound in firejail

I am using Parabola (based on Arch) and I would like to use firejail to sandbox one or two less trusted applications (steam, in particular). However, when running applications in firejail (even with ...
user avatar
  • 2,174
1 vote
1 answer
253 views

How to exclude/hide a directory from a command (find command or else)?

How to exclude a folder or path from a command or application in general? I am trying to exclude a path from find command but available possibilities like prune option explained here and here makes ...
user avatar
  • 12.9k
1 vote
1 answer
448 views

Firejail not working over socks5 SSH tunnel

I have an Ubuntu 18.04 server in which I've created two virtual interface pairs (veth0a & veth0b) and assigned the end of one interface (veth0b) to a new network namespace (netns0): ip netns add ...
user avatar
1 vote
1 answer
2k views

Sandboxing Firefox using firejail: Download directory

I have been using firejail for sandboxing my application in Ubuntu. It has a --private option. I was using firejail --private=/home/user/Desktop firefox When I try to download a file from Firefox ...
user avatar
  • 33
0 votes
0 answers
56 views

Sandboxing in ubuntu

I want to run some of my programs like skype,firefox,office suite in side seperate VMS..in Linux..Is it possible to install only an application inside a vm without installing the whole os..also i dont ...
user avatar
  • 33
0 votes
1 answer
2k views

How to use KeePassXC with Firefox and firejail

I am looking at KeePassXC on my Linux Mint Cinnamon system. The installation and initial usage all went well, following the built-in tutorial; but there is a problem with Firefox integration. After ...
user avatar
1 vote
0 answers
569 views

Sudenly, firefox is not opening at Parrot OS

I was using few times Parrot OS live booted from RAM or USB as well. Firefox is the web browser built in and my favourite by the way, so I used it. Unfortunatelly is not working properly anymore. I ...
user avatar
0 votes
1 answer
168 views

Firejailed Thunderbird, opening attachments

I am running both Firefox and Thunderbird in firejail, on Linux Mint 19.1. By coincidence, two people recently sent me emails with attached PDFs, but they were handled differently. The emails came ...
user avatar
0 votes
2 answers
298 views

Does firejail rely on the application crashing out and why can't we use named pipes to .Xauthority?

The purpose of jailing an Xorg application is to prevent it from accessing @/tmp/X11/X0 and /tmp/X11/X0 and then re-using its MIT-MAGIC-COOKIE to steal from other apps that are connected to the X ...
user avatar
  • 1
3 votes
1 answer
2k views

firejail : only let a program access localhost

I have this local network service and this client program needing to access it. I am running them both as an unprivileged user. I am looking for a way to sandbox the client using firejail, in a way ...
user avatar
  • 916
3 votes
0 answers
272 views

firejail: child-process not sandboxed?

As far as the sandbox "firejail" is concerned I´ve encountered a phenomenon which isn´t completely clear to me. My understanding has always been that whenever I start a programm/process in firejail ...
user avatar
  • 141
1 vote
1 answer
1k views

How to avoid running make as root in the last step of installing an application from source? [duplicate]

I am always reluctant to run make install as root as the last step of installing an application from source. After all, it allows executing arbitrary code form the Makefile. It has already happened to ...
user avatar
  • 440
2 votes
1 answer
2k views

firejail memory limit

I want to create a firejail profile that limits memory for applications. I'm trying to figure out if it's possible to limit memory using firejail. But It seems that some versions had the --rlimit-as ...
user avatar
  • 145
-1 votes
1 answer
656 views

firejail for complete security (for scripts downloaded from Inet)

I need to run scripts downloaded from the untrusted network. I want to run such scripts in Firejail. But firejail --caps.drop=all ls /home/porton/ shows that it has access to my home directory! It ...
user avatar
  • 2,046
1 vote
0 answers
138 views

How to install firetools in whonix?

My goal to launch browser safety, for this task I need use firejail (exists in backports repository) and firetools (not exists in main and in backports). Are there any ways install firetools on ...
user avatar
0 votes
1 answer
438 views

firejail opera browser with --private-option

I´ve created a portable version of the opera-browser (see https://gist.github.com/ruario/8416e36372f1a976a713 ). In order to open it I've got to type the command opera-developer_27.0.1670.0_amd64/...
user avatar
  • 141
0 votes
1 answer
1k views

Debian - cannot delete /etc/group- -- "Device or resource busy"

I can't remove /etc/group- -- why not? root@dom:/etc# whoami root root@dom:/etc# pwd /etc root@dom:/etc# rm -f /etc/group- rm: cannot remove ‘/etc/group-’: Device or resource busy root@dom:/etc# ...
user avatar
  • 111
5 votes
2 answers
3k views

How can I run local applications through firejail?

I've installed debian package locally. I randomly chose Opera, extracted via dkpg -x opera-x.y.z.deb ~/bin/opera_package, and created a symlink in my user's ~/bin folder (which is in the user's path). ...
user avatar
  • 101
1 vote
1 answer
1k views

Firejail or chroot [closed]

What's the difference between Firejail and chroot in case of security? I mean, should I trust a built-in tool or third-party for sandboxing untrusted applications that could be potentially targeted to ...
user avatar
0 votes
1 answer
2k views

Firejail and connecting to the Internet through an host OpenVPN client

If the host is an OpenVPN client, how would I set up Internet access for a firejail sandbox with its own network namespace?
user avatar
0 votes
1 answer
1k views

How to run firejail as root?

How can I run firejail as a root user? # firejail --seccomp firefox Reading profile /etc/firejail/firefox.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/...
user avatar
3 votes
1 answer
320 views

How to use screen when /dev/tty is disabled?

Firejail provides secure environment that strips /dev files with little number of exception. So when I try to run screen inside the environment, I get "Must be connected to a terminal". tty responds ...
user avatar
  • 347