github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1973] [information] Scenario of an attack #1324

New issue

Closed

opened 2026-05-05 07:52:01 -06:00 by gitea-mirror · 6 comments

gitea-mirror commented

2026-05-05 07:52:01 -06:00

Owner

Originally created by @g3ngr33n on GitHub (May 31, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1973

Hello,

I cannot figure out what would happen in the following scenario

Configuration

Firefox run inside a firejail sandbox which have the parameters --apparmor

Firefox doesn't have an apparmor profile, only firejail.

Scenario

An attacker exploit a vulnerability inside Firefox to gain access on the system, the attacker known a 0day that allow him to escape the firejail sandbox

What happen at this point ?

Appamor is still active and the attacker will still be restricted by the firejail profile apparmor
Since firejail is escape, apparmor is escape too

Thanks

Originally created by @g3ngr33n on GitHub (May 31, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/1973 Hello, I cannot figure out what would happen in the following scenario ## Configuration Firefox run inside a firejail sandbox which have the parameters --apparmor Firefox doesn't have an apparmor profile, only firejail. ## Scenario An attacker exploit a vulnerability inside Firefox to gain access on the system, the attacker known a 0day that allow him to escape the firejail sandbox What happen at this point ? - Appamor is still active and the attacker will still be restricted by the firejail profile apparmor - Since firejail is escape, apparmor is escape too Thanks

gitea-mirror

2026-05-05 07:52:01 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 07:52:06 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (May 31, 2018):

From what I understand when a profile uses AppArmor, Firejail will enable that early on during sandbox creation so AppArmor can protect the system if Firejail is compromised.

A hypothetical attack could be as follows

Webpage exploits a vulnerability in Firefox
Payload then escapes Firejail sandbox via D-Bus
AppArmor is bypassed using a kernel vulnerability
Host is then compromised

I might be completely wrong, and someone else can probably explain it better.

@SkewedZeppelin commented on GitHub (May 31, 2018): From what I understand when a profile uses AppArmor, Firejail will enable that early on during sandbox creation so AppArmor can protect the system if Firejail is compromised. A hypothetical attack could be as follows - Webpage exploits a vulnerability in Firefox - Payload then escapes Firejail sandbox via D-Bus - AppArmor is bypassed using a kernel vulnerability - Host is then compromised I might be completely wrong, and someone else can probably explain it better.

gitea-mirror commented

2026-05-05 07:52:08 -06:00

Author

Owner

@g3ngr33n commented on GitHub (May 31, 2018):

Thank you for this fast reply.

If you're answer is correct and I understand it correctly, there is no need to write a firefox profile apparmor in addition of the firejail one.

@g3ngr33n commented on GitHub (May 31, 2018): Thank you for this fast reply. If you're answer is correct and I understand it correctly, there is no need to write a firefox profile apparmor in addition of the firejail one.

gitea-mirror commented

2026-05-05 07:52:09 -06:00

Author

Owner

@Vincent43 commented on GitHub (Jun 4, 2018):

Firejail use generic apparmor profile which can cover (depends on distro) some things like dbus,ptrace, non-standard network access, noexec /home, writing to /proc and /sys independently of firejail own sandbox. You can make your own specfic firefox apparmor profile or use some you find o the web but then it's better to use it alone without firejail.

@Vincent43 commented on GitHub (Jun 4, 2018): Firejail use generic apparmor profile which can cover (depends on distro) some things like dbus,ptrace, non-standard network access, noexec /home, writing to /proc and /sys independently of firejail own sandbox. You can make your own specfic firefox apparmor profile or use some you find o the web but then it's better to use it alone without firejail.

gitea-mirror commented

2026-05-05 07:52:11 -06:00

Author

Owner

@FOSSONLY commented on GitHub (Jun 25, 2018):

This will never happen if:

Your browser/system is always up to date.
Browser-Extensions like uBlock, uMatrix/NoScript are present and strictly used.
Your browser always starts with Firejail and additional security-features like AppArmor.
Additional hardening like read-only volumes (ro, noexec, nosuid) are in place, and only software (100% free software) is installed who is really needed.

A 0-day exploit is also not directly able to circumvent security-features. You need mostly a very powerful exploit, or many of them in combination to get successful access. And if an attacker is getting direct access via kernel-exploit, there is no difference between Firejail or AppArmor. You lose.

If there is no AppArmor-Profile in extension to Firejail, there exist no additional security-layer if Firejail gets bypassed. And for any bypass of Seccomp/Namespaces you need an kernel-exploit, who possibly can bypass AppArmor too.

But don't worry, the Kernel-Self-Protection-Project makes very good efforts. Also additional LSM-Modules like the Linux-Kernel-Runtime-Guard, will be an interesting security-layer in future.

So the best strategy is always prevention.

Never download/execute files from untrusted sources, and never access suspicious websites.
Be very carefully with root rights. Not every service/program need them. Mostly you can drop capabilities/permissions after start.

@FOSSONLY commented on GitHub (Jun 25, 2018): This will never happen if: 1) Your browser/system is always up to date. 2) Browser-Extensions like uBlock, uMatrix/NoScript are present and strictly used. 3) Your browser always starts with Firejail and additional security-features like AppArmor. 4) Additional hardening like read-only volumes (ro, noexec, nosuid) are in place, and only software (100% free software) is installed who is really needed. A 0-day exploit is also not directly able to circumvent security-features. You need mostly a very powerful exploit, or many of them in combination to get successful access. And if an attacker is getting direct access via kernel-exploit, there is no difference between Firejail or AppArmor. You lose. If there is no AppArmor-Profile in extension to Firejail, there exist no additional security-layer if Firejail gets bypassed. And for any bypass of Seccomp/Namespaces you need an kernel-exploit, who possibly can bypass AppArmor too. But don't worry, the Kernel-Self-Protection-Project makes very good efforts. Also additional LSM-Modules like the Linux-Kernel-Runtime-Guard, will be an interesting security-layer in future. So the best strategy is always prevention. 1) Never download/execute files from untrusted sources, and never access suspicious websites. 2) Be very carefully with root rights. Not every service/program need them. Mostly you can drop capabilities/permissions after start.

gitea-mirror commented

2026-05-05 07:52:12 -06:00

Author

Owner

@g3ngr33n commented on GitHub (Jun 27, 2018):

Thanks for those information, will start to write a profile apparmor for firefox and other app and use it independantly of Firejail.

About LKRG, I made a post few days ago (see https://forums.gentoo.org/viewtopic-p-8231330.html?sid=43c8a000e3a5b2b3e7dab91706b138c5#8231330), doesn't seem to work yet on Gentoo but it is definitively a security feature that I will use

KSPP is alright, I can only thanks free security work provided by the community

@g3ngr33n commented on GitHub (Jun 27, 2018): Thanks for those information, will start to write a profile apparmor for firefox and other app and use it independantly of Firejail. About LKRG, I made a post few days ago (see https://forums.gentoo.org/viewtopic-p-8231330.html?sid=43c8a000e3a5b2b3e7dab91706b138c5#8231330), doesn't seem to work yet on Gentoo but it is definitively a security feature that I will use KSPP is alright, I can only thanks free security work provided by the community

gitea-mirror commented

2026-05-05 07:52:13 -06:00

Author

Owner

@Vincent43 commented on GitHub (Jun 27, 2018):

I think the question was answered. Nothing to do here.

@Vincent43 commented on GitHub (Jun 27, 2018): I think the question was answered. Nothing to do here.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1324

No description provided.

Rows
Columns