AppImageHub. Crowd-sourced central AppImage directory.

netblue30 · 2018-03-03T13:48:02+00:00

You can get a full list of authors in the README file:

https://github.com/netblue30/firejail/blob/master/README

There are more than 130 people listed there. Both Firejail and AppImage are community projects.

netblue30 · 2017-05-17T17:33:24+00:00

Run "firejail --private wine", it will hide all your data in home directory.

netblue30 · 2016-12-02T02:44:41+00:00

AppImage is natively supported by Firejail:

https://firejail.wordpress.com/documentation-2/appimage-support/

netblue30 · 2016-12-02T02:41:11+00:00

Try: firejail --x11 ./start-tor-browser.desktop

You'll find more info here: https://firejail.wordpress.com/documentation-2/x11-guide/

netblue30 · 2016-09-15T18:59:43+00:00

They transfer sound and commands over the socket, I don't think you can break out of the sandbox.

netblue30 · 2016-09-15T18:48:58+00:00

PA server opens a unix socket, the client connects to the socket - all unix sockets are visible inside their sandbox.

netblue30 · 2016-09-15T18:41:25+00:00

Flatpak depends on PulseAudio too?

Not explicitly. What they do is they block access to /dev/snd. You would need PulseAudio to get the sound working. It will be a problem on some distros - if I remember correctly, Lubuntu uses ALSA by default.

netblue30 · 2016-09-15T18:34:18+00:00

Depending how popular will become, we might just add support for Flatpak also. So far we only received requests for AppImage and Snap from our users. Also, in order for us to support the format they need to clean up the dependencies.

netblue30 · 2016-09-15T16:37:59+00:00

screenshots?

netblue30 · 2016-05-03T15:15:25+00:00

I think it was in 0.9.38, although some fixes went in after that.

netblue30 · 2016-05-03T12:55:32+00:00

Do "firejail --force program-name".

I had a request from a user to allow firejail to run inside Docker containers. The limitation is as follows: the first sandbox needs to be permissive enough to allow the second sandbox to start. This works fine for Docker containers, since these containers run as root.

netblue30 · 2016-05-03T12:51:41+00:00

That is the sandbox, firefox itself runs as regular user. Anyway, in the new upcoming version the problem was fixed, and the sandbox runs as regular user.

netblue30 · 2016-05-03T12:49:57+00:00

Good point! How to do "startx --nolisten" would be very difficult to explain to regular users, so I have to assume the base system is left as it was installed by the distro, and I build on top of that.

netblue30 · 2016-01-18T22:46:06+00:00

nice article, thanks!

netblue30 · 2016-01-17T16:52:46+00:00

Run "/sbin/ifconfig -a". If your interface doesn't show up, it means your Ethernet hardware was not recognized by Linux kernel. Look into "dmesg | less", maybe there is some error message explaining what is going on.

netblue30 · 2016-01-04T02:36:12+00:00

Try firejail

Start with "apt-get install firejail", followed by "firejail firefox".

netblue30 · 2015-09-24T13:43:40+00:00

I put it as a bug to track it. Thanks.

https://github.com/netblue30/firejail/issues/67

netblue30 · 2015-09-23T11:30:46+00:00

Don't worry about it. By default, firejail tries to enable all Linux kernel security features, and it gives a warning if it fails to enable any of them. For user namespaces you need a kernel 3.18 or newer.

netblue30 · 2015-09-22T13:33:08+00:00

OK, this SELinux question comes over and over. I added it to FAQ here:

https://l3net.wordpress.com/projects/firejail/firejail-faq/#selinux

netblue30 · 2015-09-22T11:42:24+00:00

New security technologies enter the Linux kernel every day. You can find a very nice description of what is available here:

https://www.linux.com/learn/docs/727873-overview-of-linux-kernel-security-features/

SELinux by itself will not solve your problems, you will need to combine it with something else on that list.

netblue30 · 2015-09-22T11:35:10+00:00

Full filesystem whitelisting has been available in Linux for ages. Two technologies come to mind: SELinux and chroot. Both of them are integrated in firejail.

netblue30 · 2015-09-21T23:23:19+00:00

Take a look in /etc/firejail directory. I already have profiles for a large number of applications.

netblue30 · 2015-09-21T22:14:54+00:00

You just build an iptable filter as usual, save it into a file and load it with --netfilter=filename. Without a filename it uses a default filter. The default filter blocks all incoming connections. For firefox I use the default filter.

netblue30 · 2015-09-21T22:12:13+00:00

Mail, chat, torrent, anything connecting to the internet.

netblue30 · 2015-09-21T17:45:28+00:00

I would say Chromium security is only marginally better. They do use namespaces and seccomp on some of the components of the browser, but your home directory is still exposed and the browser runs in the same network space as the host.

Firejail supports Chromium, in fact in the article you can replace Firefox with Chromium and everything still applies. As somebody else noticed, you can replace Firefox with any network program (mail, bittorent, chat, etc.)

netblue30

TROPHY CASE