mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #2073] How does Firejail compared to Sandboxie #1401
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#1401
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Raj2032 on GitHub (Jul 30, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2073
There is a Windows sandboxing application called 'Sandboxie' https://www.sandboxie.com. How does it differ to Firejail (other than limiting you that you can only sandbox one application at a time with the free version for Sandboxie)?
@chiraag-nataraj commented on GitHub (Jul 30, 2018):
Here's a detailed comparison (
--theseare command-line arguments you can use forfirejail):Appearance Settings
Not currently in firejail (see #1983)
Recovery Settings
Usually done with
--whitelist(for folders where you want to allow the program to see and write to) and--getto get files from other places within the sandbox. There are no exact analogues of these settings however (sincefirejailgoes to sleep after launching the program).Delete Settings
No exact analogue in
firejail— all files created by the sandbox are deleted by default with the exception of stuff in--whitelisted directories. The command used to delete the sandbox is not configurable infirejail.Program Start Settings
No analogue to Forced Folders settings. Forced Programs is similar to
sudo firecfg, which sets it up so that all programs shipped withfirejailprofiles are automatically sandboxed by default. You can do this manually (i.e. for only certain programs) by doingsudo ln -s /usr/bin/firejail /usr/local/bin/<program name>.Program Stop Settings
No analogue to these settings, but this has been an issue in the past (see #725).
File Migration Settings
No analogue to this setting. All files which are whitelisted will be copied over.
Restrictions Settings
Internet Access <->
--net=none, but--netis more powerful than that.Start/Run Access <-> No clear analogue, but we have
--private-bin, which functions in a similar way.Drop Rights <->
--noroot,--nonewprivsOther than these, there are far more options —
--private-etc,--private-lib,--private-dev,--private-srv,--caps{,.drop,.keep},--seccomp{,.block-secondary,.drop,.keep}, and so on. Check the manual page (man firejail) for more info.Resource Access Settings
File Access > Direct Access & File Access > Full Access <->
--whitelist(the distinction doesn't apply infirejail).File Access > Read-Only Access <->
--read-only.File Access > Write-Only Access <-> No exact analogue, but can use judicious
--whitelistcommands to achieve a similar effect.File Access > Blocked Access <->
--blacklist.Registry Access doesn't apply.
IPC Access <->
--ipc-namespaceWindow Access <-> Can kind of achieve a similar effect using
--x11.COM Access doesn't apply.
Applications Settings
This is basically a way to edit the profiles that are shipped with
sandboxie, so you can do the same thing by editing the.profilefiles.User Accounts Settings
Sandbox visibility is always restricted to the user who started it (as well as root) in
firejail. You can also control who can startfirejailsandboxes with/etc/firejail/firejail.users.@Raj2032 commented on GitHub (Jul 30, 2018):
Thanks for your help, but there are some things I did not understand. "
firejail uses established technologies implemented at the kernel level"
What does that mean exactly? " Also, firejail lets you isolate things like
network stacks, which don't seem to be under the purview of sandboxie" I
thought that Sandboxie does allow users to disable an application from
being connected via the Internet?
On Tue, Jul 31, 2018 at 7:25 AM ಚಿರಾಗ್ ನಟರಾಜ್ notifications@github.com
wrote:
@chiraag-nataraj commented on GitHub (Jul 30, 2018):
That's why I deleted my first comment and left the second comment (which is now the only comment) - I hadn't seen a whole bunch of configuration options in
sandboxieearlier.@Raj2032 commented on GitHub (Jul 30, 2018):
Oh I didn't realise that you deleted your first comment as I am replying to
you via email.
Also one question, am I able to launch an application and it automatically
gets sandboxed with Firejail without having to launch the application
through firejail - so like I click on the shortcut of the application
through the DE and firejail automatically sandboxes the application?
On Tue, Jul 31, 2018 at 9:23 AM ಚಿರಾಗ್ ನಟರಾಜ್ notifications@github.com
wrote:
@chiraag-nataraj commented on GitHub (Jul 30, 2018):
Yes. You can use
firecfgfor that. Or, if you don't want to automatically sandbox all supported applications, you can do something likesudo ln -s /usr/bin/firejail /usr/local/bin/<program name>.@Raj2032 commented on GitHub (Jul 30, 2018):
Oh ok thanks for that :)
Does firejail reduce the program's performance, and can malicious program
break through the firejail's security and compremise the entire OS if
possible?
On Tue, Jul 31, 2018 at 9:27 AM ಚಿರಾಗ್ ನಟರಾಜ್ notifications@github.com
wrote:
@chiraag-nataraj commented on GitHub (Jul 30, 2018):
No,
firejaildoesn't (generally) reduce the program's performance. Pretty much everythingfirejailuses is actually stuff implemented by the kernel (namespaces, seccomp-bpf, capabilities, etc). Nothing is perfect, so yes, something could defeat firejail's isolation techniques. But at that point, since the techniques are things enforced by the kernel, you have bigger issues on your hands.Fundamentally, nothing is perfect, and security is about layers - building layers of security such that you don't depend on any one layer too much. For example, you could do
firejail+apparmor+ regular UNIX permissions, in which case someone would have to defeat the isolation techniques employed byfirejailandapparmor, as well as somehow find a way to gain root. The more you add, the harder it becomes for someone to break through, realistically speaking.@Raj2032 commented on GitHub (Jul 30, 2018):
Oh I see, thanks for your help then.
On Tue, Jul 31, 2018 at 9:40 AM ಚಿರಾಗ್ ನಟರಾಜ್ notifications@github.com
wrote:
@chiraag-nataraj commented on GitHub (Jul 30, 2018):
No problem!
@Raj2032 commented on GitHub (Jul 30, 2018):
Are you the owner of Firejail?
On Tue, Jul 31, 2018 at 9:49 AM ಚಿರಾಗ್ ನಟರಾಜ್ notifications@github.com
wrote:
@chiraag-nataraj commented on GitHub (Jul 30, 2018):
No. I've contributed a bit of code, but @netblue30 "owns" firejail, I suppose.
@Raj2032 commented on GitHub (Jul 30, 2018):
Oh I see, is it written in C++?
On Tue, Jul 31, 2018 at 9:54 AM ಚಿರಾಗ್ ನಟರಾಜ್ notifications@github.com
wrote:
@chiraag-nataraj commented on GitHub (Jul 31, 2018):
It's written in C.
@Raj2032 commented on GitHub (Jul 31, 2018):
Just asking out of curosity why did you guys decide to use C over C++?
Cause I heard that with C++ you can use C features and do everything
manually without using the automated features??
On Tue, Jul 31, 2018 at 12:05 PM ಚಿರಾಗ್ ನಟರಾಜ್ notifications@github.com
wrote:
@chiraag-nataraj commented on GitHub (Jul 31, 2018):
I didn't make that decision. These questions are better answered by @netblue30.
@Raj2032 commented on GitHub (Jul 31, 2018):
Thanks for that, does he normally respond if you guys tag him?
On Tue, Jul 31, 2018 at 12:34 PM ಚಿರಾಗ್ ನಟರಾಜ್ notifications@github.com
wrote:
@chiraag-nataraj commented on GitHub (Jul 31, 2018):
Depending on the issue. I think this issue has strayed far from where it started off, and these questions should be resolved either by reading the FAQ and other material on the website (https://firejail.wordpress.com) or, if that doesn't answer your question, contacting netblue directly.