[GH-ISSUE #3815] Question: AppImage trust #2408

New issue

Closed

opened 2026-05-05 09:05:07 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 09:05:07 -06:00

Owner

Originally created by @mid-kid on GitHub (Dec 13, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3815

AppImages are essentially a binary with a disk image attached. The default way to unpack them is to just run and trust this "runtime" binary. This essentially puts trust into this binary to not do anything bad, and has a similar issue as running ldd to inspect a glibc binary.

My question is mostly: What does firejail with the --appimage option do? Is this bootstrap/runtime binary ran at all, if so, is it ran sandboxed or unsandboxed? Or does firejail reimplement this?

Originally created by @mid-kid on GitHub (Dec 13, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3815 AppImages are essentially a binary with a disk image attached. The default way to unpack them is to just run and trust this "runtime" binary. This essentially puts trust into this binary to not do anything bad, and has a similar issue as running `ldd` to inspect a glibc binary. My question is mostly: What does firejail with the `--appimage` option do? Is this bootstrap/runtime binary ran at all, if so, is it ran sandboxed or unsandboxed? Or does firejail reimplement this?

gitea-mirror closed this issue

2026-05-05 09:05:08 -06:00

gitea-mirror commented

2026-05-05 09:05:10 -06:00

Author

Owner

@smitsohu commented on GitHub (Dec 16, 2020):

Firejail doesn't use the AppImage runtime, it uses a simple reimplementation.

All AppImage code is executed in the sandbox, and that's the only possible way; everything else would defeat the very idea of a sandbox.

@smitsohu commented on GitHub (Dec 16, 2020): Firejail doesn't use the AppImage runtime, it uses a simple reimplementation. All AppImage code is executed in the sandbox, and that's the only possible way; everything else would defeat the very idea of a sandbox.

gitea-mirror commented

2026-05-05 09:05:11 -06:00

Author

Owner

@mid-kid commented on GitHub (Dec 17, 2020):

Thanks, I was worried for a second, since everything about the format is really opaque.

@mid-kid commented on GitHub (Dec 17, 2020): Thanks, I was worried for a second, since everything about the format is really opaque.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2408

No description provided.

Rows
Columns