Questions tagged [sandbox]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
1 answer
47 views

how can i make a dbus connection from a sandbox to pipewire

How can i create a DBUS connection to PipeWire (to communicate with the sound daemon) from a SElinux sandbox?
ministry's user avatar
1 vote
0 answers
79 views

SELinux sandboxed firefox has no audio

Running firefox in a SELinux sandbox using this script: Random variables for directories, Allowing multiple instances SEhome=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 8 | head -n 1) SEtemp=$(...
ministry's user avatar
0 votes
0 answers
508 views

How to clear the contents under /run/user/1000/doc?

I am on Ubuntu 20.04 and installed evince via flatpak, when I open evince, it usually makes a copy of the opened file into /run/user/1000/doc. I learned that /run/user/1000/doc is the temporary ...
Simon.Zh.1234's user avatar
1 vote
0 answers
128 views

unprivileged_userns_apparmor_policy - what does it do?

I am developing some AppArmor profiles, and came across the kernel flag unprivileged_userns_apparmor_policy, but I cannot find any documentation about it. Does anyone know what it does? I wonder if ...
schmeg's user avatar
  • 21
0 votes
2 answers
44 views

How to test an outdated version of the Firefox web browser on an up to date system?

I tried to run Firefox 4 on Debian 11 to test a web site for ES5 compatibility. I managed to run NCSA Mosaic on Debian 11 using Flatpak, but this was too old: it crashes directly, when loading my site....
ceving's user avatar
  • 3,461
2 votes
0 answers
159 views

Sandboxing user sessions with systemd

I would like to sandbox a user session on a remote Linux VM similarly as one can sandbox a systemd service. For example, in the service file I can add to [Service] sections lines like: NoNewPrivileges=...
Igor Bukanov's user avatar
0 votes
0 answers
257 views

Snaps vs Flatpaks from a security standpoint

Snap vs Flatpak: I was wondering which one is more secure. I've heard a lot of criticism of Flatpak's sandboxing. Which sandbox is better isolated and hard to evade?
Fingon's user avatar
  • 1
0 votes
0 answers
349 views

Give a Flatpak application access to host filesystem but not to home directory

I want to run an application (a Jetbrains IDE) with Flatpak and I want it to have access to my host's filesystem (to pickup the required SDKs) to not have access to my full home directory, but only ~/...
mat's user avatar
  • 290
2 votes
1 answer
383 views

Jail/Sandbox process on an overlay root and track changes

What I am trying to achieve I want to run a process as an unprivileged user, but all files that are changed by this process should be only changed in a shadow folder. Furthermore, I want to disable ...
Raphael Jenni's user avatar
8 votes
1 answer
548 views

Firefox spamming SECCOMP events to journal/syslog - how to fix?

Since I updated to the snap-based Firefox on Ubuntu recently, I see it reporting SECCOMP_RET_TRAP messages to the journal whenever some application is drawing a canvas. And since applications drawing ...
foo's user avatar
  • 134
0 votes
2 answers
615 views

How to use wine with more security?

After installing Wine I found that there is a z drive that has direct access to root folder. I have seen many threads and news about virus affecting a linux system through wine. How do I make it more ...
Sohan Arafat's user avatar
0 votes
0 answers
343 views

Is it possible to sandbox Wine in a way that mitigates all security risks from running Windows apps/games and having Wine installed?

And if that is more or less possible, how can it be done? Using firejail is probably part of it but not the full story. I'd like to install Wine to be able to play Windows games that don't have native ...
mYnDstrEAm's user avatar
  • 4,088
3 votes
0 answers
303 views

How to run a child process inside firejail sandbox?

Hello Linux folks i need help running with firejail with a java program that is in sandbox firejail --private --trace java -jar program.jar But this program can't spawn child process (chromium) due to ...
geek's user avatar
  • 179
1 vote
1 answer
280 views

Create flatpak runtime with specified /usr and similar dirs

What I'm trying to build is a flatpak runtime that will use /usr as symlink to say /my/usr or the host /usr. That way existing containers and host runtime can be used for apps that are either not ...
ratcher86's user avatar
4 votes
0 answers
596 views

How do I run wine with bubblewrap?

I am trying to run Windows games with wine and bubblewrap so that they are sandboxed. When I run the command below: bwrap \ --ro-bind /bin /bin \ --ro-bind /lib /lib \ --ro-bind /lib64 /...
Bagalaw's user avatar
  • 835
0 votes
1 answer
64 views

In Gnome, why does starting a favorited sandboxed application create a new icon on the dash?

I think this is something that's easier to show than tell. So you see in this image of my dash, I clicked on the Tor icon with the gradient background, but it actually opened the application using a ...
gdi's user avatar
  • 143
0 votes
1 answer
94 views

Linux sandbox that shows which files have been created/modified

I use Gentoo Linux. I need to find out what the program running under root downloads and where it puts the downloaded files. I would also like to have a sandbox for testing programs from unreliable ...
GangsterVano's user avatar
2 votes
1 answer
562 views

How to debug systemd seccomp SystemCallFilter unit-name.service: Main process exited, code=killed, status=31/SYS?

systemd unit file: [Service] SystemCallFilter=[...] Error message: unit-name.service: Main process exited, code=killed, status=31/SYS How to find out which system call is missing in the whitelist?
adrelanos's user avatar
  • 1,786
0 votes
1 answer
24 views

Suspending programs running under a certain user

I am isolating less trusted programs that need access to x (such as web browsers) with this method. https://wiki.gentoo.org/wiki/Simple_sandbox But any program that has access to my x session can log ...
herringbottom's user avatar
1 vote
0 answers
820 views

Isolating users running containers in the same account

Multiple users are running container images on the same user account on a supercomputer ("service account"). Each container mounts a folder that contains sensitive data. One service account ...
itsmemario's user avatar
0 votes
1 answer
145 views

Packages download defaults to be sandboxed

Why most Linux packages download defaults to be operated under sandbox canceling su privilege ? E.g. is on debian W: Download is performed unsandboxed as root as file ... Please one elaborate sandbox ...
user avatar
0 votes
1 answer
855 views

Allow to run Telegram (or any other application) via firejail, prevent it from running directly

Preferably without using sudo. So far I've just saved it under /opt/telegram/Telegram without adding it to $PATH but that's not a solution since I can easily run it accidentally.
Artem S. Tashkinov's user avatar
0 votes
1 answer
369 views

How to spawn each child process in separate pid namespace

How to spawn each child in a separate PID namespace using unshare (without CLONE_NEWPID flag in child process clone syscall). I am able to successfully spawn first child in PID namespace but I am not ...
Karthik Nedunchezhiyan's user avatar
0 votes
1 answer
1k views

How to run external executables within firejail

My machine is home desktop(personal) running Debian Buster with i3 window manager. I recently installed firejail with apt install firejail* firetools and also downloaded the new Firefox 83 browser ...
atheros's user avatar
  • 256
-1 votes
1 answer
125 views

Run compilation safely in sandbox

How to run compilation safely in sandbox? If I download something from GitHub, how to be safe from malware when compiling it? Linux (Ubuntu).
porton's user avatar
  • 2,146
1 vote
1 answer
428 views

AppArmor equivalent to Firejail --net=none

firejail --net=none creates a sandbox looking like a computer without any network interfaces. Is it possible to achieve the same result with AppArmor? It looks like, AppArmor's deny network just ...
Trudy's user avatar
  • 794
1 vote
1 answer
811 views

create custom profile to run man using firejail

I'm trying to use firejail (version 0.9.58.2) for application sandboxing on my Debian Stable machine. From what I understand it's possible to create a custom configuration file for each application ...
n0542344's user avatar
  • 376
-1 votes
1 answer
78 views

Isolate non-FOSS "completely"

My question today is about the access-rights and control a program gets systemwide. I use a Linux distro as my daily-driver, mainly for software development but also for daily operations. I really ...
user654789384's user avatar
0 votes
1 answer
7k views

I can not run google chrome without --no-sandbox argument

I have this version of kali linux : Linux kali 5.7.0-kali1-amd64 #1 SMP Debian 5.7.6-1kali2 (2020-07-01) x86_64 GNU/Linux I have downloaded google chrome from chrome's website, then I have installed ...
X Y's user avatar
  • 117
0 votes
0 answers
199 views

SELinux sandbox on debian buster

I have installed and enabled SELinux on Debian 10 (Buster). Running sandbox however returns: /usr/bin/sandbox: Sandbox Policy is not currently installed. You need to install the selinux-policy-...
Yan Foto's user avatar
  • 103
0 votes
0 answers
399 views

Systemd PrivateTmp and JoinsNamespaceOf

I have two service definitions which look like this: service_a.service: [Unit] Description=ServiceA [Service] JoinsNamespaceOf=service_b.service PrivateTmp=yes service_b.service: [Unit] Description=...
Curunir's user avatar
  • 111
2 votes
1 answer
2k views

Launching Electron on Ubuntu WSL

I am running a WSL2 Ubuntu system. I'm attempting to follow this tutorial to launch an Electron boilerplate. When running yarn dev I come across this error: [14143:0218/164010.657008:FATAL:...
Alex Williams's user avatar
2 votes
2 answers
3k views

Why does root user cannot create browser sandbox?

Error: Running as root without --no-sandbox is not supported. In Linux, why cannot the root user create sandbox for chrome or opera browsers like other users? Why should the root user need to launch ...
PaxPrz's user avatar
  • 255
4 votes
0 answers
117 views

Separate clipboard for particular application

Is it possible, on Debian with Klipper running, to have a separate "clipboard stack" for a particular application? I'd like the text that I copy in application Y not to be shared with all the other ...
xmeric's user avatar
  • 49
1 vote
0 answers
291 views

sandbox skype,spotify on ubuntu

I am trying to sandbox applications such as Skype/Spotify on Ubuntu 18.04. Both are installed under snap, which limits their access to system folders (although skype is installed using '--classic' ...
redo's user avatar
  • 11
0 votes
3 answers
78 views

How run Softwares as a snapshot?

I want to run the software as non-persistent, which means if any configuration is changed, they revert. In the Windows, Software Sandboxie has this amazing feature. When the program is started, it ...
Monu's user avatar
  • 155
0 votes
1 answer
780 views

How to harden apt with seccomp in Debian 10?

Here it says "[...] APT [...] can make use of seccomp-BPF sandboxing" and describes how to do so only by: APT::Sandbox::Seccomp is a boolean to turn it on/off That's a bit sparse imo. Where should ...
mYnDstrEAm's user avatar
  • 4,088
0 votes
1 answer
217 views

pivot_root(2) causes system crash

I am trying to change the root of my process to new file system that I mounted at /tmp/mount_dir and i have created another directory inside it /tmp/mount_dir/inner_mount_dir, and according to the man ...
o.awajan's user avatar
4 votes
0 answers
1k views

Where to find more infos about Xwayland command line options?

My gnome-session starts a Xwayland instance which I can find $> pgrep -a Xwayland 995 /usr/bin/Xwayland :0 -rootless -terminate -accessx -core -listen 4 -listen 5 -displayfd 6 which shows that ...
humanityANDpeace's user avatar
2 votes
1 answer
114 views

Run a program and see what it changes in the system

I have a closed-source VPN program that messes up my system (Fedora Linux): I run it, it changes something, VPN works, but when I terminate the connection, my system is left in a dirty state and the ...
The Data Scientician's user avatar
3 votes
1 answer
2k views

firejail : only let a program access localhost

I have this local network service and this client program needing to access it. I am running them both as an unprivileged user. I am looking for a way to sandbox the client using firejail, in a way ...
tbrugere's user avatar
  • 966
4 votes
0 answers
387 views

firejail: child-process not sandboxed?

As far as the sandbox "firejail" is concerned I´ve encountered a phenomenon which isn´t completely clear to me. My understanding has always been that whenever I start a programm/process in firejail ...
Rosika's user avatar
  • 151
2 votes
4 answers
2k views

Create temporary empty environment in Linux [closed]

Is it possible to create a temporary empty environment for a new user in a Shell like Bash or zsh? I mean like the incognito mode in Chrome which opens an isolated environment in which everything you ...
soner's user avatar
  • 96
1 vote
1 answer
2k views

How to avoid running make as root in the last step of installing an application from source? [duplicate]

I am always reluctant to run make install as root as the last step of installing an application from source. After all, it allows executing arbitrary code form the Makefile. It has already happened to ...
Zoltan's user avatar
  • 456
0 votes
1 answer
260 views

Mismatched APT Dependencies

I have Synergy installed on Ubuntu 18.04 (this is not the new version 2, fwiw). Apparently, it has a requirement of libcurl3. However, the machine also runs as a hypervisor and I need to use ...
mredig's user avatar
  • 101
2 votes
2 answers
449 views

How can we easily revert the changes made by experiements with unfamiliar commands? [closed]

Sometimes I would like to experiment with some commands which I am unfamiliar with (e.g. xmodmap), and also have the ability to revert the changes very easily without knowing much about the commands ...
Tim's user avatar
  • 99.1k
1 vote
1 answer
158 views

How to properly sandbox a program that may hang the computer

Recently I compiled a program in GNU MIX. The program is rather simple and only contains an unconditional jump to the only instruction, which is essentially a infinite loop. The problem is, when I ...
Weijun Zhou's user avatar
  • 3,338
3 votes
1 answer
949 views

Restrict clipboard for untrusted X11 clients

I've came across this blog https://notehub.org/rp5n2 which describes a way to make certain X11 clients untrusted[1], which makes certain X11 extensions unavailable to them. Note that I know perfectly ...
woky's user avatar
  • 422
1 vote
0 answers
428 views

Example setup for zita-njbridge in multicast mode?

Do you have a working zita-njbridge triplet of command lines (one n2j, two j2n) proven to run in multicast mode, which you might share? I'd like to study a working example, to compare to my special ...
Jonathan Brickman of Topeka KS's user avatar
4 votes
0 answers
436 views

What exactly is Flatpak and what are its main use-cases? [closed]

I just noticed that the current update of the distribution I'm using (version 18.3 of Linux Mint) boasts supports for "Flatpak". So, I ddg'ed it and found this Wikipedia page about yet. So I ...
einpoklum's user avatar
  • 8,862