[GH-ISSUE #4186] Enhancement starting firejail before runit,openrc,sysinitv and systemd service, and sandboxing early startup process. #2569

New issue

Closed

opened 2026-05-05 09:14:36 -06:00 by gitea-mirror · 1 comment

gitea-mirror commented

2026-05-05 09:14:36 -06:00

Owner

Originally created by @osevan on GitHub (Apr 13, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4186

https://gitlab.com/apparmor/apparmor/-/wikis/FullSystemPolicy

With this method above, we can trying to start sysinitv and rest of system startup apps like big attackvector systemd in sandbox with own networknamespace and profile.

Profiles needed for these apps :
Sysinitv
Systemd
Runit
Openrc
Upstart

Originally created by @osevan on GitHub (Apr 13, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/4186 https://gitlab.com/apparmor/apparmor/-/wikis/FullSystemPolicy With this method above, we can trying to start sysinitv and rest of system startup apps like big attackvector systemd in sandbox with own networknamespace and profile. Profiles needed for these apps : Sysinitv Systemd Runit Openrc Upstart

gitea-mirror closed this issue

2026-05-05 09:14:37 -06:00

gitea-mirror commented

2026-05-05 09:14:39 -06:00

Author

Owner

@rusty-snake commented on GitHub (Apr 13, 2021):

AppArmor is in an other position, it is part of the kernel which is started before the init. Firejail runs in the userspace.

--> https://github.com/netblue30/firejail/discussions/4163#discussioncomment-568144 <--

systemd needs to be pid1 IIRC and we don't want to be pid1 because

pid1 is special, and if pid1 crashes the system crashes.
systemd (and SysVinit, OpenRC, ...) needs access to nearly everything because it's the init. It needs to be root, and have the permission to (u)mount, modprobe, prctl, seccomp, bpf, execve anything, ALL, EVERYTHING. What should be sandboxed there?
Firejail sandboxes inherit, sandboxing your init means one sandbox for everything.

Sysinitv, Runit, Openrc

It's possible to integrate firejail is start scripts. Network setup and deamons (if possible) run sandboxed.

For systemd you should use it's native sandboxing features. Examples: https://github.com/netblue30/firejail/discussions/4077.

Upstart

Is dead, is't it?

@rusty-snake commented on GitHub (Apr 13, 2021): AppArmor is in an other position, it is part of the kernel which is started before the init. Firejail runs in the userspace. --> **https://github.com/netblue30/firejail/discussions/4163#discussioncomment-568144** <-- systemd needs to be pid1 IIRC and we don't want to be pid1 because 1. pid1 is special, and if pid1 crashes the system crashes. 2. systemd (and SysVinit, OpenRC, ...) needs access to nearly everything because it's the init. It needs to be root, and have the permission to (u)mount, modprobe, prctl, seccomp, bpf, execve anything, ALL, EVERYTHING. What should be sandboxed there? 3. Firejail sandboxes inherit, sandboxing your init means one sandbox for everything. > Sysinitv, Runit, Openrc It's possible to integrate firejail is start scripts. Network setup and deamons (if possible) run sandboxed. For systemd you should use it's native sandboxing features. Examples: https://github.com/netblue30/firejail/discussions/4077. > Upstart Is dead, is't it?

gitea-mirror referenced this issue

2026-05-05 10:19:40 -06:00

[PR #2569] [MERGED] Fix and harden soundconverter #4415

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2569

No description provided.

Rows
Columns