mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #3999] Firejail usage #2498
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2498
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @tansm11 on GitHub (Feb 20, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3999
My laptop OS is Linux Mint 19.1 "Tessa" Cinnamon edition (64-bit).
Before Linux, I was using Windows 10. I installed and used a software called Sandboxie. Sandboxie runs your programs in an isolated space which prevents them from making permanent changes to other programs and data in your computer.
I can install any Windows application in what they called sandbox and then run the Windows application in the sandbox. When I throw away the sandbox, everything that is written to it will be lost. This is extremely useful when I try out suspicious software. If the software contains malware or I just don't like it, I just throw away the sandbox and the program disappears completely.
It also offers secure web browsing by running your Web browser under the protection of Sandboxie means that all malicious software downloaded by the browser is trapped in the sandbox and can be discarded.
Will Firejail work like Sandboxie?
Let's say I want to try out software XX. So, I go install software XX. Then, I run software XX. I don't like it. So, I want everything to be completely disappeared like as if software XX has never been installed. How do I go about it using Firejail?
@rusty-snake commented on GitHub (Feb 20, 2021):
No, it's an other software. Best you start some reading.
https://firejail.wordpress.com/features-3/
https://firejail.wordpress.com/documentation-2/
On Linux you install software usually with your packages manager, so the install/remove is very difficult to sandbox. However have a look at the
privateandprivate-homefeatures.You should not do this.
@FOSSONLY commented on GitHub (Feb 20, 2021):
This has changed in the meantime. While I can't speak for other package managers, apt has been running under a restricted user (_apt) for quite some time, and also has an optional seccomp filter that can be enabled (APT::Sandbox::Seccomp "1") in apt's configuration.
@tansm11 commented on GitHub (Feb 20, 2021):
Is there any way to make Firejail to do like this? :
I create a container/sandbox. I install a software. I run the software. I delete/remove the container/sandbox and the software I had been installed will completely disappeared like as if the software has never been installed.
@rusty-snake commented on GitHub (Feb 20, 2021):
But still has full write access to the file-system, it doesn't? I see no real benefit if it can write to sudoers or bashrc or whatever. From what kind of attacker should it protect?
Sound podman/docker is more what you search for. However, you could use the
chrootfeature or use AppImages.@tansm11 commented on GitHub (Feb 22, 2021):
That is close but not close to what I'm looking for.
I'm thinking if Firejail can do like this:
I run Firejail. Then, I install a Linux software (doesn't matter whether from Debian package or from Terminal or from Software Manager) and then I run the Linux software. Then, I close/shutdown Firejail. Whatever filesystem modifications have been done while installing and running the software all will be gone. The host filesystem is not touched. Is that possible?
@rusty-snake commented on GitHub (Mar 14, 2021):
As I said podman is closer to that what you need IMO.
Matters because Software Manager uses PackageKit.
With
--overlayfs-tmpfs. However it is disable.@tansm11 commented on GitHub (Mar 15, 2021):
Maybe I didn't make it clear enough.
Actually, I want to try out a Linux software but I don't want it to make any changes to my real Linux computer system (starting from the time I install it until the time I run it and until the time after I remove it). How can I do that using Firejail?
@rusty-snake commented on GitHub (Mar 15, 2021):
With the overlayfs feature. But it is disabled at the moment, so you need to workaround it with the chroot feature or by use an other software (docker, podman, runc, crun, bwrap, mount, minijail, systemd-nspawn (example 6), lxc, lxd, ...) together with firejail or not.
To warn again: PackageKit uses D-Bus and therefore it shoots back. (If you want to say so)
@tansm11 commented on GitHub (Mar 15, 2021):
So, it seems that the overlayfs feature is the closest to the one that I'm looking for. Oh no!.....Please don't be disabled.
@rusty-snake commented on GitHub (Mar 16, 2021):
I played a bit: Test successfully start
zenity --info@tansm11 commented on GitHub (Mar 18, 2021):
You mentioned "podman: SELinux kicks in", so it works or not?
@rusty-snake commented on GitHub (Mar 18, 2021):
Did more playing with podman: It works with
--security-opt=label=disable.@tansm11 commented on GitHub (Mar 18, 2021):
For "mount -t overlay + firejail", what are the steps to apply?
@rusty-snake commented on GitHub (Mar 18, 2021):
Collected form my shell history, maybe not complete.
@tansm11 commented on GitHub (Mar 18, 2021):
For "systemd-nspawn (example 6)", it virtualizes host system together with any removable drives that connected to my computer?
@rusty-snake commented on GitHub (Mar 18, 2021):
It does not virtualizes anything. virtualization is kvm (for example), emulation is qemu (for example; except qemu-kvm). All tools I listed have no virtualization/emulation.
Yes, like firejail, bwrap or podman (always depending on the used arguments/parameters/commands/options/flags/...).
@rusty-snake commented on GitHub (Mar 18, 2021):
What I did for testing:
@tansm11 commented on GitHub (Mar 18, 2021):
Yes, it does virtualizes. If you read the description of systemd-nspawn, it stated there:
systemd-nspawn may be used to run a command or OS in a light-weight namespace container. In many ways it is similar to chroot(1), but more powerful since it fully virtualizes the file system hierarchy, as well as the process tree, the various IPC subsystems and the host and domain name.
@rusty-snake commented on GitHub (Mar 18, 2021):
The file system (and some other ns), but not the host system (which includes your cpu, disk, ...). Anyway these are quibbles.
@tansm11 commented on GitHub (Mar 18, 2021):
I'm sorry I think I have misunderstood about that virtualize thing.
Let's get back to "systemd-nspawn (example 6)".
It runs a copy of the host system in a snapshot and at the same time it runs a copy of any removable drives that connected to my computer in that same snapshot?
@rusty-snake commented on GitHub (Mar 18, 2021):
Yes, it's like
mkdir /new_root && cp -r --reflink=auto --exclude=/new_root / /new_root(cp has no--exclude).... but it can also bind, robind and overlayfs.
@tansm11 commented on GitHub (Mar 18, 2021):
While it runs a copy of the host system in a snapshot, is there any way to whitelist any removable drives that connected to my computer? So that while it runs a copy of the host system in a snapshot, I can still save anything onto any removable drives that connected to my computer during its runtime and that saving in that removable drives will not be lost on shutdown.
@rusty-snake commented on GitHub (Mar 18, 2021):
Just
--bindthe upper directory.@tansm11 commented on GitHub (Mar 19, 2021):
You mean I just
--bindthe internal hard drive of my computer?@rusty-snake commented on GitHub (Mar 19, 2021):
No
--bind/mediaor/run/mediaor where else the external driver gets mounted.@tansm11 commented on GitHub (Mar 19, 2021):
Oh, okay.
@rusty-snake commented on GitHub (Aug 4, 2021):
I'm closing here due to inactivity, please fell free to request to reopen if you have more questions.