github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1987] Question: benefits of running Firejail with AppArmor? #1336

New issue

Closed

opened 2026-05-05 07:53:33 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 07:53:33 -06:00

Owner

Originally created by @infokiller on GitHub (Jun 10, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1987

Hey,

I'm currently (happily) using Firejail and considering using AppArmor as well. I expect this to add some complexity, so I want to make sure I understand the benefits of doing it.
What are the benefits of running both?
I know that there is some overlap between them, but can't really point out what protections AppArmor has that Firejail is lacking (or vice versa).

Also, if I want to run both, is the recommended way to install Firejail with AppArmor support and then add apparmor to /etc/firejail/globals.local?

Thanks!

Originally created by @infokiller on GitHub (Jun 10, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/1987 Hey, I'm currently (happily) using Firejail and considering using AppArmor as well. I expect this to add some complexity, so I want to make sure I understand the benefits of doing it. What are the benefits of running both? I know that there is some overlap between them, but can't really point out what protections AppArmor has that Firejail is lacking (or vice versa). Also, if I want to run both, is the recommended way to install Firejail with AppArmor support and then add `apparmor` to `/etc/firejail/globals.local`? Thanks!

gitea-mirror

2026-05-05 07:53:33 -06:00

closed this issue
added the
question_old
label

gitea-mirror commented

2026-05-05 07:53:38 -06:00

Author

Owner

@Vincent43 commented on GitHub (Jun 11, 2018):

The benefits of generic firejail AppArmor profile are:

blocking dbus access (=<0.9.54, only ubuntu)
blocking ptrace access
blocking writing to /sys and /proc (with few exceptions)
blocking non-standard network sockets (only inet,inet6,unix,netling,raw are allowed - ubuntu)
block executing binaries from /home
whitelisting writing to system sockets under /run/*

Generally speaking AppArmor support is just a supplement to firejail. It's hard to develop strict profile which is then used for every possible app. Users can add their own modifications to /etc/apparmor.d/local/firejail-local profile, i.e. deny /some/secret/dir-or-program rw. Another issue is that some features like networking and dbus socket mediation are currently available only in Ubuntu distros so there is a disparity in AppArmor effectiveness on different OSes. That may be improved later this year.

Also, if I want to run both, is the recommended way to install Firejail with AppArmor support and then add apparmor to /etc/firejail/globals.local?

Some profiles have already apparmor enabled and will use it when AppArmor support is detected on system. Adding apparmor to globals.local is another option. I would recommend observing access denials in audit logs to see if anything breaks.

@Vincent43 commented on GitHub (Jun 11, 2018): The benefits of generic firejail AppArmor profile are: - blocking dbus access (=<0.9.54, only **ubuntu**) - blocking ptrace access - blocking writing to /sys and /proc (with few exceptions) - blocking non-standard network sockets (only inet,inet6,unix,netling,raw are allowed - **ubuntu**) - block executing binaries from /home - whitelisting writing to system sockets under /run/* Generally speaking AppArmor support is just a supplement to firejail. It's hard to develop strict profile which is then used for every possible app. Users can add their own modifications to `/etc/apparmor.d/local/firejail-local profile`, i.e. `deny /some/secret/dir-or-program rw`. Another issue is that some features like networking and dbus socket mediation are currently available only in Ubuntu distros so there is a disparity in AppArmor effectiveness on different OSes. That may be improved later this year. > Also, if I want to run both, is the recommended way to install Firejail with AppArmor support and then add apparmor to /etc/firejail/globals.local? Some profiles have already `apparmor` enabled and will use it when AppArmor support is detected on system. Adding `apparmor` to `globals.local` is another option. I would recommend observing access denials in audit logs to see if anything breaks.

gitea-mirror commented

2026-05-05 07:53:40 -06:00

Author

Owner

@infokiller commented on GitHub (Jun 11, 2018):

Thanks a lot @Vincent43 for the thorough response, it's very useful!
I'm running Arch Linux, so it seems that I won't get some of the Ubuntu-only AppArmor goodies you mentioned.
Do you know of a bug I can track in order to be notified when these features will be available in distros other than Ubuntu?

Thanks!

@infokiller commented on GitHub (Jun 11, 2018): Thanks a lot @Vincent43 for the thorough response, it's very useful! I'm running Arch Linux, so it seems that I won't get some of the Ubuntu-only AppArmor goodies you mentioned. Do you know of a bug I can track in order to be notified when these features will be available in distros other than Ubuntu? Thanks!

gitea-mirror commented

2026-05-05 07:53:41 -06:00

Author

Owner

@Vincent43 commented on GitHub (Jun 11, 2018):

You can follow AppArmor kernel development here and userspace utilities here

Mailinglist used by developers is here

Here you can view fresh presentation about plans for future development. Linux 4.19 and AppArmor 3.0 are current targets for complete dbus and networking support.

@Vincent43 commented on GitHub (Jun 11, 2018): You can follow AppArmor kernel development [here](https://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor.git/) and userspace utilities [here](https://gitlab.com/apparmor/apparmor) Mailinglist used by developers is [here](https://lists.ubuntu.com/mailman/listinfo/apparmor) [Here](https://gitlab.com/apparmor/apparmor/blob/master/presentations/apparmor-opensuse-2018.odp) you can view fresh presentation about plans for future development. Linux 4.19 and AppArmor 3.0 are current targets for complete dbus and networking support.

gitea-mirror commented

2026-05-05 07:53:43 -06:00

Author

Owner

@infokiller commented on GitHub (Jun 12, 2018):

Thanks a lot @Vincent43 this is very helpful!

@infokiller commented on GitHub (Jun 12, 2018): Thanks a lot @Vincent43 this is very helpful!

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1336

No description provided.

Rows
Columns