github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #607] A question which I couldn't find in the FAQ #425

New issue

Closed

opened 2026-05-05 05:50:02 -06:00 by gitea-mirror · 1 comment

gitea-mirror commented

2026-05-05 05:50:02 -06:00

Owner

Originally created by @ox42 on GitHub (Jun 30, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/607

Hi, I have a question. If this is not the right place for that, please let me know where I can ask it, and feel free to close the issue.

Basically, I'm a teacher and I need to organize a course. Students will submit programming assignments and I want to execute them locally. After compiling them, can I just prefix the programs with firejail - and what would that achieve exactly?

For example, will it stop:
- programs trying to modify/delete important system files
- programs trying to read system files which can compromise system security (though I can't think of anything atm)
- programs trying to send sensitive data through the network (net=none should do the trick?)
- programs trying to exhaust system resources (the solution is probably cgroups?)
- programs trying to fill disk space by outputting large amounts of data to files (can this be prevented)?

What parameters would you pass to "firejail" if you needed to run those programs on your computer?

Thank you very much. Sorry for the long question, but I'm really curious, given that Firejail looks great.

Originally created by @ox42 on GitHub (Jun 30, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/607 Hi, I have a question. If this is not the right place for that, please let me know where I can ask it, and feel free to close the issue. Basically, I'm a teacher and I need to organize a course. Students will submit programming assignments and I want to execute them locally. After compiling them, can I just prefix the programs with firejail - and what would that achieve exactly? For example, will it stop: - programs trying to modify/delete important system files - programs trying to read system files which can compromise system security (though I can't think of anything atm) - programs trying to send sensitive data through the network (net=none should do the trick?) - programs trying to exhaust system resources (the solution is probably cgroups?) - programs trying to fill disk space by outputting large amounts of data to files (can this be prevented)? What parameters would you pass to "firejail" if you needed to run those programs on your computer? Thank you very much. Sorry for the long question, but I'm really curious, given that Firejail looks great.

gitea-mirror

2026-05-05 05:50:02 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 05:50:08 -06:00

Author

Owner

@netblue30 commented on GitHub (Jun 30, 2016):

I would suggest you build a virtual machine, install firejail in it and run the programs there. It is very unlikely your students will be able to break out of firejail, but just in case...

programs trying to modify/delete important system files

programs trying to read system files which can compromise system security (though I can't think of anything atm)

A simple "firejail program-name" should protect you in these cases.

programs trying to send sensitive data through the network (net=none should do the trick?)

Yes, --net=none would do it.

programs trying to exhaust system resources (the solution is probably cgroups?)

Yes, look into setting up a control group, and pass it to firejail using --cgroup.

programs trying to fill disk space by outputting large amounts of data to files (can this be prevented)?

There is a setquota command, I've never tried it. Here are some examples: http://www.linuxnix.com/how-to-linux-group-disk-quota-implementation/ and https://gehrcke.de/2013/05/setting-up-quotas-on-a-local-linux-file-system/

What parameters would you pass to "firejail" if you needed to run those programs on your computer?

I would run "firejail --private --net=none program-name".

@netblue30 commented on GitHub (Jun 30, 2016): I would suggest you build a virtual machine, install firejail in it and run the programs there. It is very unlikely your students will be able to break out of firejail, but just in case... > - programs trying to modify/delete important system files > - programs trying to read system files which can compromise system security (though I can't think of anything atm) A simple "firejail program-name" should protect you in these cases. > - programs trying to send sensitive data through the network (net=none should do the trick?) Yes, --net=none would do it. > - programs trying to exhaust system resources (the solution is probably cgroups?) Yes, look into setting up a control group, and pass it to firejail using --cgroup. > - programs trying to fill disk space by outputting large amounts of data to files (can this be prevented)? There is a setquota command, I've never tried it. Here are some examples: http://www.linuxnix.com/how-to-linux-group-disk-quota-implementation/ and https://gehrcke.de/2013/05/setting-up-quotas-on-a-local-linux-file-system/ > What parameters would you pass to "firejail" if you needed to run those programs on your computer? I would run "firejail --private --net=none program-name".

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#425

No description provided.

Rows
Columns