github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #686] detecting malware? #471

New issue

Closed

opened 2026-05-05 05:55:27 -06:00 by gitea-mirror · 5 comments

gitea-mirror commented

2026-05-05 05:55:27 -06:00

Owner

Originally created by @xahare on GitHub (Aug 5, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/686

Can firejail log policy violations or otherwise alert the user to bugs or malicious activity?

Originally created by @xahare on GitHub (Aug 5, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/686 Can firejail log policy violations or otherwise alert the user to bugs or malicious activity?

gitea-mirror

2026-05-05 05:55:27 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 05:55:32 -06:00

Author

Owner

@manevich commented on GitHub (Aug 5, 2016):

See --tracelog option for logging. But note - this is implemented using LD_PRELOAD and it's not too hard to get round for malware, AFAIK.

@manevich commented on GitHub (Aug 5, 2016): See `--tracelog` option for logging. But note - this is implemented using `LD_PRELOAD` and it's not too hard to get round for malware, AFAIK.

gitea-mirror commented

2026-05-05 05:55:35 -06:00

Author

Owner

@manevich commented on GitHub (Aug 6, 2016):

implemented using LD_PRELOAD

Actually /etc/ld.so.preload. (I was answering late at night)

@manevich commented on GitHub (Aug 6, 2016): > implemented using LD_PRELOAD Actually `/etc/ld.so.preload`. (I was answering late at night)

gitea-mirror commented

2026-05-05 05:55:38 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Aug 9, 2016):

@xahare it's easier to just whitelist the behaviors you want the program to have access to than to try to heuristically detect whether it's acting maliciously. For example, I quarantine my browser (Firefox) to my Downloads directory (and its configuration files) and a private-tmp as well as limit the binaries and files in /etc that it has access to. I also disable the root user, limit which syscalls it has access to, and don't give it access to a shell (it doesn't need one). This is in addition to using addons like uMatrix to limit the number and scope of scripts that run on a page. Basically, my point is that it's easier (although quite tedious) to think about the behaviors you want and to whitelist them than to try to figure out if some specific behavior you saw is malicious (even if you're the one trawling through the logs - and firejail has pretty detailed logging).

@chiraag-nataraj commented on GitHub (Aug 9, 2016): @xahare it's easier to just whitelist the behaviors you want the program to have access to than to try to heuristically detect whether it's acting maliciously. For example, I quarantine my browser (Firefox) to my Downloads directory (and its configuration files) and a `private-tmp` as well as limit the binaries and files in /etc that it has access to. I also disable the root user, limit which syscalls it has access to, and don't give it access to a shell (it doesn't need one). This is in addition to using addons like uMatrix to limit the number and scope of scripts that run on a page. Basically, my point is that it's easier (although quite tedious) to think about the behaviors you want and to whitelist them than to try to figure out if some specific behavior you saw is malicious (even if you're the one trawling through the logs - and `firejail` has pretty detailed logging).

gitea-mirror commented

2026-05-05 05:55:40 -06:00

Author

Owner

@xahare commented on GitHub (Aug 11, 2016):

@chiraag-nataraj that sounds awsome! can you gist your firefox setup?

the point of this isn't better protection. its knowing when somethings wrong that you would otherwise miss.

@xahare commented on GitHub (Aug 11, 2016): @chiraag-nataraj that sounds awsome! can you gist your firefox setup? the point of this isn't better protection. its knowing when somethings wrong that you would otherwise miss.

gitea-mirror commented

2026-05-05 05:55:41 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Aug 11, 2016):

So my profile is attached here (rename it to firefox.profile)

The list of privacy/security addons I use in Firefox (mainly for privacy, but they also provide some added security):
Decentraleyes (https://addons.mozilla.org/en-US/firefox/addon/decentraleyes/)
Disconnect (https://addons.mozilla.org/en-US/firefox/addon/disconnect/)
RequestPolicy (https://addons.mozilla.org/en-US/firefox/addon/requestpolicy-continued/)
Self-Destructing Cookies (https://addons.mozilla.org/en-US/firefox/addon/self-destructing-cookies/)
uBlock Origin (https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/)
uMatrix (https://addons.mozilla.org/en-US/firefox/addon/umatrix/)

the point of this isn't better protection. its knowing when somethings wrong that you would otherwise miss.

Fair enough 😄 I just happen to believe that a whitelist of actions along with a restrictive firewall can generally limit any damage that may occur 😉

@chiraag-nataraj commented on GitHub (Aug 11, 2016): So my profile is attached [here](https://github.com/netblue30/firejail/files/413401/firefox.txt) (rename it to firefox.profile) The list of privacy/security addons I use in Firefox (mainly for privacy, but they also provide some added security): Decentraleyes (https://addons.mozilla.org/en-US/firefox/addon/decentraleyes/) Disconnect (https://addons.mozilla.org/en-US/firefox/addon/disconnect/) RequestPolicy (https://addons.mozilla.org/en-US/firefox/addon/requestpolicy-continued/) Self-Destructing Cookies (https://addons.mozilla.org/en-US/firefox/addon/self-destructing-cookies/) uBlock Origin (https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/) uMatrix (https://addons.mozilla.org/en-US/firefox/addon/umatrix/) > the point of this isn't better protection. its knowing when somethings wrong that you would otherwise miss. Fair enough :smile: I just happen to believe that a _whitelist_ of actions along with a restrictive firewall can generally limit any damage that may occur :wink:

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#471

No description provided.

Rows
Columns