Questions tagged [sandbox]
The sandbox tag has no usage guidance.
84
questions
0
votes
0answers
47 views
How do I run wine with bubblewrap?
I am trying to run Windows games with wine and bubblewrap so that they are sandboxed. When I run the command below:
bwrap \
--ro-bind /bin /bin \
--ro-bind /lib /lib \
--ro-bind /lib64 /...
0
votes
1answer
16 views
In Gnome, why does starting a favorited sandboxed application create a new icon on the dash?
I think this is something that's easier to show than tell.
So you see in this image of my dash, I clicked on the Tor icon with the gradient background, but it actually opened the application using a ...
0
votes
1answer
59 views
Linux sandbox that shows which files have been created/modified
I use Gentoo Linux.
I need to find out what the program running under root downloads and where it puts the downloaded files.
I would also like to have a sandbox for testing programs from unreliable ...
0
votes
0answers
32 views
Selinux change root mapping
I want to control some accesses of root in Linux- fedora, for example, I want to run a process and I want root not to be able to kill it.
I use SELinux and I changed root mapping from unconfined to ...
2
votes
0answers
149 views
How to debug systemd seccomp SystemCallFilter unit-name.service: Main process exited, code=killed, status=31/SYS?
systemd unit file:
[Service]
SystemCallFilter=[...]
Error message:
unit-name.service: Main process exited, code=killed, status=31/SYS
How to find out which system call is missing in the whitelist?
0
votes
0answers
223 views
Fedoras default thunderbird-bug does not allow opening attachments in edit mode
On any Fedora (but a least not for all other distributions) in the preinstalled thunderbird-version it is not possible to open an attachement of a e-mail in edit-modus (e.g. you are currently writing ...
0
votes
0answers
249 views
Does Snap "partial confinement" override user-set permissions?
I am using Snap 2.49-1 on Debian Bullseye/Sid. Whenever I run a snap in terminal, I get the warning WARNING: cgroup v2 is not fully supported yet, proceeding with partial confinement.
Meanwhile, IPFS (...
0
votes
1answer
19 views
Suspending programs running under a certain user
I am isolating less trusted programs that need access to x (such as web browsers) with this method.
https://wiki.gentoo.org/wiki/Simple_sandbox
But any program that has access to my x session can log ...
0
votes
0answers
264 views
Isolating users running containers in the same account
Multiple users are running container images on the same user account on a supercomputer ("service account"). Each container mounts a folder that contains sensitive data. One service account ...
0
votes
1answer
28 views
Packages download defaults to be sandboxed
Why most Linux packages download defaults to be operated under sandbox canceling su privilege ?
E.g. is on debian
W: Download is performed unsandboxed as root as file ...
Please one elaborate sandbox ...
0
votes
1answer
336 views
Allow to run Telegram (or any other application) via firejail, prevent it from running directly
Preferably without using sudo.
So far I've just saved it under /opt/telegram/Telegram without adding it to $PATH but that's not a solution since I can easily run it accidentally.
0
votes
1answer
137 views
How to spawn each child process in separate pid namespace
How to spawn each child in a separate PID namespace using unshare (without CLONE_NEWPID flag in child process clone syscall). I am able to successfully spawn first child in PID namespace but I am not ...
0
votes
1answer
473 views
How to run external executables within firejail
My machine is home desktop(personal) running Debian Buster with i3 window manager. I recently installed firejail with apt install firejail* firetools and also downloaded the new Firefox 83 browser ...
-1
votes
1answer
61 views
Run compilation safely in sandbox
How to run compilation safely in sandbox?
If I download something from GitHub, how to be safe from malware when compiling it?
Linux (Ubuntu).
1
vote
1answer
189 views
AppArmor equivalent to Firejail --net=none
firejail --net=none creates a sandbox looking like a computer without any network interfaces.
Is it possible to achieve the same result with AppArmor? It looks like, AppArmor's deny network just ...
1
vote
1answer
257 views
create custom profile to run man using firejail
I'm trying to use firejail (version 0.9.58.2) for application sandboxing on my Debian Stable machine. From what I understand it's possible to create a custom configuration file for each application ...
-1
votes
1answer
48 views
Isolate non-FOSS "completely"
My question today is about the access-rights and control a program gets systemwide.
I use a Linux distro as my daily-driver, mainly for software development but also for daily operations.
I really ...
1
vote
0answers
4k views
I can not run google chrome without --no-sandbox argument
I have this version of kali linux :
Linux kali 5.7.0-kali1-amd64 #1 SMP Debian 5.7.6-1kali2 (2020-07-01) x86_64 GNU/Linux
I have downloaded google chrome from chrome's website, then I have installed ...
0
votes
0answers
126 views
SELinux sandbox on debian buster
I have installed and enabled SELinux on Debian 10 (Buster). Running sandbox however returns:
/usr/bin/sandbox: Sandbox Policy is not currently installed.
You need to install the selinux-policy-...
0
votes
0answers
122 views
Systemd PrivateTmp and JoinNameSpaceOf
I have two service definition which look like this:
service_a.service:
[Unit]
Description=ServiceA
[Service]
JoinsNamespaceOf=service_b.service
PrivateTmp=yes
service_b.service:
[Unit]
Description=...
2
votes
1answer
1k views
Launching Electron on Ubuntu WSL
I am running a WSL2 Ubuntu system. I'm attempting to follow this tutorial to launch an Electron boilerplate.
When running yarn dev I come across this error:
[14143:0218/164010.657008:FATAL:...
1
vote
2answers
1k views
Why does root user cannot create browser sandbox?
Error: Running as root without --no-sandbox is not supported.
In Linux, why cannot the root user create sandbox for chrome or opera browsers like other users?
Why should the root user need to launch ...
4
votes
0answers
91 views
Separate clipboard for particular application
Is it possible, on Debian with Klipper running, to have a separate "clipboard stack" for a particular application?
I'd like the text that I copy in application Y not to be shared with all the other ...
1
vote
0answers
247 views
sandbox skype,spotify on ubuntu
I am trying to sandbox applications such as Skype/Spotify on Ubuntu 18.04.
Both are installed under snap, which limits their access to system folders (although skype is installed using '--classic' ...
0
votes
3answers
60 views
How run Softwares as a snapshot?
I want to run the software as non-persistent, which means if any configuration is changed, they revert.
In the Windows, Software Sandboxie has this amazing feature. When the program is started, it ...
-1
votes
1answer
562 views
How to harden apt with seccomp in Debian 10?
Here it says "[...] APT [...] can make use of seccomp-BPF sandboxing" and describes how to do so only by:
APT::Sandbox::Seccomp is a boolean to turn it on/off
That's a bit sparse imo. Where should ...
0
votes
1answer
106 views
pivot_root(2) causes system crash
I am trying to change the root of my process to new file system that I mounted at /tmp/mount_dir and i have created another directory inside it /tmp/mount_dir/inner_mount_dir, and according to the man ...
4
votes
0answers
552 views
Where to find more infos about Xwayland command line options?
My gnome-session starts a Xwayland instance which I can find
$> pgrep -a Xwayland
995 /usr/bin/Xwayland :0 -rootless -terminate -accessx -core -listen 4 -listen 5 -displayfd 6
which shows that ...
2
votes
1answer
100 views
Run a program and see what it changes in the system
I have a closed-source VPN program that messes up my system (Fedora Linux): I run it, it changes something, VPN works, but when I terminate the connection, my system is left in a dirty state and the ...
3
votes
1answer
1k views
firejail : only let a program access localhost
I have this local network service and this client program needing to access it. I am running them both as an unprivileged user.
I am looking for a way to sandbox the client using firejail, in a way ...
3
votes
0answers
224 views
firejail: child-process not sandboxed?
As far as the sandbox "firejail" is concerned I´ve encountered a phenomenon which isn´t completely clear to me.
My understanding has always been that whenever I start a programm/process in firejail ...
2
votes
4answers
1k views
Create temporary empty environment in Linux [closed]
Is it possible to create a temporary empty environment for a new user in a Shell like Bash or zsh?
I mean like the incognito mode in Chrome which opens an isolated environment in which everything you ...
1
vote
1answer
981 views
How to avoid running make as root in the last step of installing an application from source? [duplicate]
I am always reluctant to run make install as root as the last step of installing an application from source. After all, it allows executing arbitrary code form the Makefile. It has already happened to ...
0
votes
1answer
232 views
Mismatched APT Dependencies
I have Synergy installed on Ubuntu 18.04 (this is not the new version 2, fwiw). Apparently, it has a requirement of libcurl3. However, the machine also runs as a hypervisor and I need to use ...
2
votes
2answers
201 views
How can we easily revert the changes made by experiements with unfamiliar commands? [closed]
Sometimes I would like to experiment with some commands which I am unfamiliar with (e.g. xmodmap), and also have the ability to revert the changes very easily without knowing much about the commands ...
1
vote
1answer
123 views
How to properly sandbox a program that may hang the computer
Recently I compiled a program in GNU MIX. The program is rather simple and only contains an unconditional jump to the only instruction, which is essentially a infinite loop.
The problem is, when I ...
3
votes
1answer
710 views
Restrict clipboard for untrusted X11 clients
I've came across this blog https://notehub.org/rp5n2 which describes a way to make certain X11 clients untrusted[1], which makes certain X11 extensions unavailable to them. Note that I know perfectly ...
1
vote
0answers
330 views
Example setup for zita-njbridge in multicast mode?
Do you have a working zita-njbridge triplet of command lines (one n2j, two j2n) proven to run in multicast mode, which you might share?
I'd like to study a working example, to compare to my special ...
4
votes
0answers
366 views
What exactly is Flatpak and what are its main use-cases? [closed]
I just noticed that the current update of the distribution I'm using (version 18.3 of Linux Mint) boasts supports for "Flatpak". So, I ddg'ed it and found this Wikipedia page about yet.
So I ...
1
vote
1answer
829 views
Computing sandbox with ptrace inspecting
I want to launch untrusted compute-only executables in linux server. Process will have no access to system and files except stdin and stdout
My idea is to use ptrace to catch and block syscalls to ...
13
votes
4answers
10k views
Merge changes to upper filesystem to lower filesystem in Linux Overlay (OverlayFS) mount
I would like to be able to merge changes from the upper filesystem of an overlay mount to a lower filesystem.
I am interested both online (i.e. merge while the overlay is mounted) and offline (...
0
votes
1answer
247 views
Sandboxing Chrome (or other browser)
I'm wanting to run Chrome with an encrypted home directory (Ubuntu) but I want to make sure that nothing is leaking outside of the encrypted directory, such as /tmp. How might I accomplish this? ...
1
vote
0answers
175 views
Program to track file / directory changes in Linux
I am currently trying to make a sandbox environment that enables me to open potential Phishing e-mails in a safe environment. There are other articles on this in the security stack exchange (https://...
1
vote
0answers
151 views
What is machine-id?
Just read the machine-id manpage, still not clear on how it's used by applications. QuiteRSS and Firefox among others seem to use it. Is it generally safe to blacklist (using apparmor) certain ...
3
votes
1answer
246 views
How to access only world readable files in SElinux sandbox
I want to run programs made as student assignments in an SELinux sandbox (to check output and behaviour as a first part of grading the assignments without having to check very closely if some students ...
5
votes
3answers
4k views
How can I "sandbox" a shell script?
I have a shell script like so:
#/bin/sh
#do some stuff
But the interpreter, sh is not in /bin/ but instead in another directory. Similarly, the script creates folders in directories I have no write ...
7
votes
2answers
8k views
why php can not see /tmp files
i have simple test.php page:
<pre><?php system("ls -la /tmp"); ?></pre>
which always shows just: . and .. folders and nothing else in browser.
in the command line:
1) ls -la /...
2
votes
0answers
147 views
How to sandbox JVM on a CentOS [closed]
I'm looking for the best way to sandbox a JVM process running on CentOS. The process must not be allowed to spawn subprocesses, call ptrace or kill, write access should be limited only to specific ...
1
vote
1answer
1k views
Firejail or chroot [closed]
What's the difference between Firejail and chroot in case of security? I mean, should I trust a built-in tool or third-party for sandboxing untrusted applications that could be potentially targeted to ...
0
votes
1answer
898 views
sandbox firejail --overlay
I´ve got a problem with firejail. In principle this sandbox works quite well. I can start a browser (firefox/midori) and other applications as well (like rhythmbox). What I want to do now is use the ...