Questions tagged [firejail]
The firejail tag has no usage guidance.
42
questions
0
votes
0
answers
28
views
can' t use keepassxc with Brave/Vivaldi and firejail
I have Fedora 38 Cinnamon system. Since a couple of weeks I can’t use Keepassxc with Brave/Vivaldi. I also use firejail for extra security. After adding KeePassXC-Browser to Brave/Vivaldi, I had an ...
- 1
0
votes
0
answers
35
views
firejail --x11=xephyr goes to sleep after 10 minutes
I run any program through Firejail using the option X11 xephyr (to isolate X11).
A separate program window opens as it should, but after 10 minutes of inactivity the screen goes dark. If you move the ...
- 1
-6
votes
1
answer
254
views
How can I mitigate the keylogging issue of Xorg?
My plan is to:
Turn off listening to all sockets, and initiate X through a command
such as: Xorg -nolisten tcp -nolisten inet -nolisten inet6 -nolisten unix -nolisten local :0 -seat seat0 vt7 -...
- 45
2
votes
1
answer
461
views
Firejail --private can't launch .sh file in home directory
I can create a bash script, then launch it using firejail with the private option :
phil@GLaDOS:~$ echo "echo success" > /media/phil/Stockage/firejailtest.sh; chmod +x /media/phil/...
- 331
1
vote
0
answers
65
views
How to run GNU Emacs 28 in firejail with the firefox profile?
I'd like to be able to run GNU Emacs 28 from a Firefox running in firejail, but it gives the following error:
emacs: could not load dump file "/usr/libexec/emacs/28.1/x86_64-linux-gnu/emacs.pdmp&...
- 12k
3
votes
0
answers
322
views
How to run a child process inside firejail sandbox?
Hello Linux folks i need help running with firejail with a java program that is in sandbox
firejail --private --trace java -jar program.jar
But this program can't spawn child process (chromium) due to ...
- 179
1
vote
1
answer
835
views
Firejail not hiding files with Brave browser
If I run the following:
firejail brave-browser
And then try and access files in the browser (such as when uploading a file), Brave still has access to my entire home folder.
Usually this doesn't ...
- 143
3
votes
0
answers
130
views
Firejail not hiding files with Brave browser
If I run the following:
firejail brave-browser
And then try and access files in the browser (such as when uploading a file), Brave still has access to my entire home folder.
Usually this doesn't ...
- 143
2
votes
1
answer
600
views
Firejail overlay permissions and ALSA no sound (wrong group in container/jail)
I'll try to be brief and concise. I want to run programs that require ALSA with firejail profiles but it probably doesn't have the permission or ability to access the soundcard for some reason ...
- 23
0
votes
1
answer
908
views
Allow to run Telegram (or any other application) via firejail, prevent it from running directly
Preferably without using sudo.
So far I've just saved it under /opt/telegram/Telegram without adding it to $PATH but that's not a solution since I can easily run it accidentally.
- 27.2k
0
votes
1
answer
1k
views
How to run external executables within firejail
My machine is home desktop(personal) running Debian Buster with i3 window manager. I recently installed firejail with apt install firejail* firetools and also downloaded the new Firefox 83 browser ...
- 256
0
votes
1
answer
330
views
Error when excecuting firejail from zathura: cannot create /run/firejail/profile/14844
In zathura, I use :exec firejail firefox to start firefox with firejail. There is an error "cannot create /run/firejail/profile/14844" and firefox does not start. When I type firejail ...
1
vote
1
answer
886
views
create custom profile to run man using firejail
I'm trying to use firejail (version 0.9.58.2) for application sandboxing on my Debian Stable machine. From what I understand it's possible to create a custom configuration file for each application ...
- 376
0
votes
1
answer
311
views
Can't click button of firefox when I run it within firejail + xephyr
I run firefox with the following command:
firejail --x11=xephy firefox
The command usually opens a firefox window (800x600) that fills the xephyr window (800x600). In this case, the following ...
- 49
1
vote
1
answer
622
views
firejail: wine regedit doesn't save changes
Update2:
Registry's changes actually saved. But for entries that will not be permanently stored (that be reset if, for example run wineboot), after regedit (with firejail) is closed, those entries are ...
- 73
2
votes
2
answers
4k
views
Whitelist a directory for execution with firejail
How can I whitelist a directory for execution with firejail?
In particular, I would like to execute Firefox Nightly in firejail. But I get the following error:
$ firejail --profile=/etc/firejail/...
- 12k
3
votes
1
answer
527
views
Port forwarding with iptables and firejail sandbox
I try to run a HTTP server on port 8000 in a firejail sandbox, and make it accessible on all interfaces of the host on port 8888.
The whole system can be represented as below:
+----------------------...
- 51
1
vote
1
answer
694
views
Disable --noprofile in Firejail
How can I disable the --noprofile option in Firejail? For example, is it possible to disable the use of this option in firejail.config so that no one can use it.
- 445
1
vote
0
answers
586
views
Netfilter bypass through Firejail
For isolation, I run Firefox through Xephyr with Openbox. In the Firejail profile, I set net enp2a1 to isolate the network through network namespaces. But I don’t like that a regular user can override ...
- 445
5
votes
0
answers
594
views
Opening /proc/<pid>/net/dev prevents network namespace from expiring, is this expected?
I'm looking for input whether the following observation related to network namespace expiration is expected, or should be reported as bug?
When some process opens /proc/<pid>/net/dev it can ...
- 51
0
votes
2
answers
1k
views
Problems with sound in firejail
I am using Parabola (based on Arch) and I would like to use firejail to sandbox one or two less trusted applications (steam, in particular). However, when running applications in firejail (even with ...
- 2,348
1
vote
1
answer
510
views
How to exclude/hide a directory from a command (find command or else)?
How to exclude a folder or path from a command or application in general?
I am trying to exclude a path from find command but available possibilities like prune option explained here and here makes ...
- 14.1k
1
vote
1
answer
650
views
Firejail not working over socks5 SSH tunnel
I have an Ubuntu 18.04 server in which I've created two virtual interface pairs (veth0a & veth0b) and assigned the end of one interface (veth0b) to a new network namespace (netns0):
ip netns add ...
- 35
1
vote
1
answer
3k
views
Sandboxing Firefox using firejail: Download directory
I have been using firejail for sandboxing my application in Ubuntu. It has a --private option. I was using
firejail --private=/home/user/Desktop firefox
When I try to download a file from Firefox ...
- 33
0
votes
0
answers
72
views
Sandboxing in ubuntu
I want to run some of my programs like skype,firefox,office suite in side seperate VMS..in Linux..Is it possible to install only an application inside a vm without installing the whole os..also i dont ...
- 33
0
votes
1
answer
3k
views
How to use KeePassXC with Firefox and firejail
I am looking at KeePassXC on my Linux Mint Cinnamon system. The installation and initial usage all went well, following the built-in tutorial; but there is a problem with Firefox integration.
After ...
- 327
1
vote
0
answers
775
views
Sudenly, firefox is not opening at Parrot OS
I was using few times Parrot OS live booted from RAM or USB as well. Firefox is the web browser built in and my favourite by the way, so I used it.
Unfortunatelly is not working properly anymore. I ...
- 21
-1
votes
1
answer
185
views
Firejailed Thunderbird, opening attachments
I am running both Firefox and Thunderbird in firejail, on Linux Mint 19.1.
By coincidence, two people recently sent me emails with attached PDFs, but they were handled differently. The emails came ...
- 327
0
votes
2
answers
356
views
Does firejail rely on the application crashing out and why can't we use named pipes to .Xauthority?
The purpose of jailing an Xorg application is to prevent it from accessing @/tmp/X11/X0 and /tmp/X11/X0 and then re-using its MIT-MAGIC-COOKIE to steal from other apps that are connected to the X ...
- 1
3
votes
1
answer
2k
views
firejail : only let a program access localhost
I have this local network service and this client program needing to access it. I am running them both as an unprivileged user.
I am looking for a way to sandbox the client using firejail, in a way ...
- 976
4
votes
0
answers
399
views
firejail: child-process not sandboxed?
As far as the sandbox "firejail" is concerned I´ve encountered a phenomenon which isn´t completely clear to me.
My understanding has always been that whenever I start a programm/process in firejail ...
- 151
1
vote
1
answer
2k
views
How to avoid running make as root in the last step of installing an application from source? [duplicate]
I am always reluctant to run make install as root as the last step of installing an application from source. After all, it allows executing arbitrary code form the Makefile. It has already happened to ...
- 456
3
votes
1
answer
2k
views
firejail memory limit
I want to create a firejail profile that limits memory for applications.
I'm trying to figure out if it's possible to limit memory using firejail.
But It seems that some versions had the --rlimit-as ...
- 155
-1
votes
1
answer
802
views
firejail for complete security (for scripts downloaded from Inet)
I need to run scripts downloaded from the untrusted network.
I want to run such scripts in Firejail.
But firejail --caps.drop=all ls /home/porton/ shows that it has access to my home directory! It ...
- 2,166
1
vote
0
answers
151
views
How to install firetools in whonix?
My goal to launch browser safety, for this task I need use firejail (exists in backports repository) and firetools (not exists in main and in backports).
Are there any ways install firetools on ...
- 13
0
votes
1
answer
534
views
firejail opera browser with --private-option
I´ve created a portable version of the opera-browser (see https://gist.github.com/ruario/8416e36372f1a976a713 ).
In order to open it I've got to type the command opera-developer_27.0.1670.0_amd64/...
- 151
0
votes
1
answer
2k
views
Debian - cannot delete /etc/group- -- "Device or resource busy"
I can't remove /etc/group- -- why not?
root@dom:/etc# whoami
root
root@dom:/etc# pwd
/etc
root@dom:/etc# rm -f /etc/group-
rm: cannot remove ‘/etc/group-’: Device or resource busy
root@dom:/etc# ...
- 111
5
votes
2
answers
4k
views
How can I run local applications through firejail?
I've installed debian package locally. I randomly chose Opera, extracted via dkpg -x opera-x.y.z.deb ~/bin/opera_package, and created a symlink in my user's ~/bin folder (which is in the user's path). ...
- 101
1
vote
1
answer
2k
views
Firejail or chroot [closed]
What's the difference between Firejail and chroot in case of security? I mean, should I trust a built-in tool or third-party for sandboxing untrusted applications that could be potentially targeted to ...
- 263
0
votes
1
answer
2k
views
Firejail and connecting to the Internet through an host OpenVPN client
If the host is an OpenVPN client, how would I set up Internet access for a
firejail sandbox with its own network namespace?
- 111
0
votes
1
answer
1k
views
How to run firejail as root?
How can I run firejail as a root user?
# firejail --seccomp firefox
Reading profile /etc/firejail/firefox.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/...
- 2,983
3
votes
1
answer
373
views
How to use screen when /dev/tty is disabled?
Firejail provides secure environment that strips /dev files with little number of exception. So when I try to run screen inside the environment, I get "Must be connected to a terminal". tty responds ...
- 377