[GH-ISSUE #675] A basic comprehension question #461

New issue

Closed

opened 2026-05-05 05:54:42 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 05:54:42 -06:00

Owner

Originally created by @curiosity-seeker on GitHub (Aug 1, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/675

On this github site Firejail is described as follows:

Firejail is a SUID sandbox program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces, seccomp-bpf and Linux capabilities.

On the other hand you once wrote:

This is how the sandbox works:

First, it configures a new home directory (blacklists, whitelists etc.) It is basically a chroot created on the fly.

Second, a seccomp filter will prevent the intruder to escape the chroot.

Third, just in case he managed to remove the chroot, a Linux capabilites (man 7 capabilities) filter is installed. This disables kernel module loading, filesystem mounts, changing networking system etc. Basically all sysadmin actions are disabled.

As a layman I have a hard time to understand how namespaces and chroot work together. Is the respective application running in a chroot sandbox within a namespace? Or was your phrasing "basically a chroot" only another term for namespace?

Sorry for this naive question - I'm only trying to understand some basics. An article on the Firejail homepage explaining some details would be highly appreciated!

Originally created by @curiosity-seeker on GitHub (Aug 1, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/675 On this github site Firejail is described as follows: > Firejail is a SUID sandbox program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces, seccomp-bpf and Linux capabilities. On the other hand you [once](https://github.com/netblue30/firejail/issues/99#issuecomment-151187459) wrote: > This is how the sandbox works: > > First, it configures a new home directory (blacklists, whitelists etc.) It is basically a chroot created on the fly. > > Second, a seccomp filter will prevent the intruder to escape the chroot. > > Third, just in case he managed to remove the chroot, a Linux capabilites (man 7 capabilities) filter is installed. This disables kernel module loading, filesystem mounts, changing networking system etc. Basically all sysadmin actions are disabled. As a layman I have a hard time to understand how namespaces and chroot work together. Is the respective application running in a [chroot sandbox](http://www.insanitybit.com/2014/09/08/sandboxing-chroot-sandbox/) within a namespace? Or was your phrasing "basically a chroot" only another term for namespace? Sorry for this naive question - I'm only trying to understand some basics. An article on the Firejail homepage explaining some details would be highly appreciated!

gitea-mirror

2026-05-05 05:54:42 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 05:54:45 -06:00

Author

Owner

@netblue30 commented on GitHub (Aug 2, 2016):

I'll have to rewrite it, thanks.

@netblue30 commented on GitHub (Aug 2, 2016): I'll have to rewrite it, thanks.

gitea-mirror commented

2026-05-05 05:54:47 -06:00

Author

Owner

@netblue30 commented on GitHub (Sep 6, 2016):

First, it configures a new home directory (blacklists, whitelists etc.) It is basically a chroot created on the fly.

This is wrong, is more like a container not a chroot. I'll start dropping chroot and use container instead.

@netblue30 commented on GitHub (Sep 6, 2016): > First, it configures a new home directory (blacklists, whitelists etc.) It is basically a chroot created on the fly. This is wrong, is more like a container not a chroot. I'll start dropping chroot and use container instead.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#461

No description provided.

Rows
Columns