FireJail - Linux sandbox

Discussion in 'all things UNIX' started by Gitmo East, Oct 16, 2014.

  1. summerheat

    summerheat Registered Member

    Joined:
    May 16, 2015
    Posts:
    899
    I don't know as I haven't checked how the configure file in that *.tar.xz file looks like. If it contains a line

    ac_default_prefix=/usr/local

    we've found the culprit.
     
  2. wat0114

    wat0114 Registered Member

    Joined:
    Aug 5, 2012
    Posts:
    2,047
    Location:
    Canada
    just checked in gedit and yes, it's in there.
     
  3. wat0114

    wat0114 Registered Member

    Joined:
    Aug 5, 2012
    Posts:
    2,047
    Location:
    Canada
    BTW @summerheat,

    this discussion with you has been beneficial in other ways. After exploring through some of the firejail profiles, it occurred to me that I could simply put my options in the profile, rather than creating a separate launcher for them :oops: So now in the chromium.profile I've added:

    Code:
    caps.keep sys_chroot,sys_admin 
    x11 xorg
    nonewprivs
    ...and deleted the custom launcher. I also generated symlinks with your suggestion: sudo firecfg

    Thanks for your help :thumb:
     
  4. summerheat

    summerheat Registered Member

    Joined:
    May 16, 2015
    Posts:
    899
    You're very welcome! I'm glad that I could help you.
     
  5. summerheat

    summerheat Registered Member

    Joined:
    May 16, 2015
    Posts:
    899
    That script works well but can be simplified by using git pull which fetches only changes from the git repository which makes the download size much smaller.

    So this is what I recommend:

    If you're installing the git branch of Firejail for the first time use this script:
    Code:
    cd ~
    rm -rf ~/firejail
    git clone https://github.com/netblue30/firejail.git
    cd firejail
    ./configure --prefix=/usr
    make
    sudo make install
    From now on use this script in order to update Firejail:
    Code:
    cd ~/firejail
    git pull
    ./configure --prefix=/usr
    make
    sudo make install
    
    Works well for me.
     
  6. wat0114

    wat0114 Registered Member

    Joined:
    Aug 5, 2012
    Posts:
    2,047
    Location:
    Canada
    Thanks summerheat! Will this script still work even if I installed firejail using one of the tar.xz archives from sourceforge?
     
  7. summerheat

    summerheat Registered Member

    Joined:
    May 16, 2015
    Posts:
    899
    Well, the ~/firejail diretory must exist and it must be identical with the one created by git clone. I don't know if that's the case.
     
  8. SuperSapien

    SuperSapien Registered Member

    Joined:
    Apr 9, 2015
    Posts:
    146
    Is Firejail compatible with the Slimjet browser and Kodi Player?
     
  9. summerheat

    summerheat Registered Member

    Joined:
    May 16, 2015
    Posts:
    899
    Firejail doesn't come with ready-to-use profiles for those applications. So you have to create your own ones which shouldn't be too difficult. See also this site for whitelisted profiles.
     
  10. vasa1

    vasa1 Registered Member

    Joined:
    May 1, 2010
    Posts:
    4,166
    I'm running the Openbox session of Lubuntu 16.04 with the version of Firejail that is supplied in the repos, version 0.9.38.10. I know it's old, but some sort of support is implied in https://firejail.wordpress.com/download-2/ by "Firejail Long Term Support: 0.9.38.10".

    My issue is that I couldn't get "--noprofile --overlay" to work with Firefox. The browser would open just fine but there wasn't any network connectivity. The same was true of two other browsers, netsurf and google-chrome.

    Then I came across https://github.com/netblue30/firejail/issues/151#issuecomment-159978829 and later comments in that same issue which related to a similar difficulty. It turns out that both the person who raised the issue and I are using WiFi and that that was the reason why just "--noprofile --overlay" doesn't work.

    The developer suggested trying
    Code:
    firejail --noprofile --overlay --dns=8.8.8.8 --dns=8.8.4.4
    and this works for me. I'm very curious that in all the pages in this long thread there's just one mention, on the first page, of "--overlay". Why isn't "--overlay" more popular with Wilders' members?
     
  11. summerheat

    summerheat Registered Member

    Joined:
    May 16, 2015
    Posts:
    899
    I must admit that I've never tried it so I'm not sure what it does exactly. :confused:
     
  12. vasa1

    vasa1 Registered Member

    Joined:
    May 1, 2010
    Posts:
    4,166
    Well, to quote from the man pages of my version:
    Code:
           --overlay
                  Mount  a  filesystem  overlay on top of the current filesystem. All
                  filesystem modifications go  into  the  overlay.   The  overlay  is
                  stored in $HOME/.firejail directory.
    
                  OverlayFS  support  is  required in Linux kernel for this option to
                  work.  OverlayFS was officially introduced in Linux kernel  version
                  3.18
    
                  Example:
                  $ firejail --overlay firefox
    
           --overlay-tmpfs
                  Mount  a  filesystem  overlay on top of the current filesystem. All
                  filesystem modifications go into the  overlay,  and  are  discarded
                  when the sandbox is closed.
    
                  OverlayFS  support  is  required in Linux kernel for this option to
                  work.  OverlayFS was officially introduced in Linux kernel  version
                  3.18
    
                  Example:
                  $ firejail --overlay-tmpfs firefox
    
           --overlay-clean
                  Clean  all  overlays  stored in $HOME/.firejail directory. Overlays
                  created with --overlay-path=path outside $HOME/.firejail  will  not
                  be deleted.
    
                  Example:
                  $ firejail --overlay-clean
    
           --private
                  Mount  new  /root  and /home/user directories in temporary filesys‐
                  tems. All modifications are discarded when the sandbox is closed.
    
                  Example:
                  $ firejail --private firefox
    
    It seems somewhat related to "--private". And "--overlay-tmpfs" seems similar to "--private" though I don't know what advantage one has over the other.
     
Loading...