About

Whitelisted home directory in Mozilla Firefox

Whitelisted home directory in Mozilla Firefox

Firejail is a SUID program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces and seccomp-bpf. It allows a process and all its descendants to have their own private view of the globally shared kernel resources, such as the network stack, process table, mount table.

Written in C with virtually no dependencies, the software runs on any Linux computer with a 3.x kernel version or newer. The sandbox is lightweight, the overhead is low. There are no complicated configuration files to edit, no socket connections open, no daemons running in the background. All security features are implemented directly in Linux kernel and available on any Linux computer.

Firejail can sandbox any type of processes: servers, graphical applications, and even user login sessions. The software includes security profiles for a large number of Linux programs: Mozilla Firefox, Chromium, VLC, Transmission etc. To start the sandbox, prefix your command with “firejail”:

$ firejail firefox                       # starting Mozilla Firefox
$ firejail transmission-gtk              # starting Transmission BitTorrent 
$ firejail vlc                           # starting VideoLAN Client
$ sudo firejail /etc/init.d/nginx start  # starting nginx web server

We also develop a graphical user interface, Firetools. Distributed as a separate package, the application is built using Qt4/Qt5 libraries. It provides a sandbox launcher integrated with the system tray, sandbox editing, management and statistics.

Firetools: launcher and sandbox stats

Firetools: launcher and sandbox stats

 

News

July 2016 – released Firejail version 0.9.42~rc1 (download). This release brings in AppImage support, sandbox auditing support, and a number of smaller features and bug fixes. Release Notes, Release Announcement.

June 2016 – released Firetools version 0.9.40.1 (download). This is a bugfix release.

May 2016 – released Firetools version 0.9.40 (download). This release includes Grsecurity support, protocols, cup cores, sandbox name and X11 sandboxing support in the stats section, and a number of updates and bug fixes. A file manager that allows the user to browse the filesystem inside the sandbox is also included in this release.

May 2016 – released Firejail version 0.9.40 (download). This release includes a number of major features, such as X11 sandboxing support, file transfers between sandboxes and the host system, run-time configuration support, AppArmor and Grsecurity support, and firecfg, a desktop configuration utility. A number of smaller features, documentation and bugfixes are also included. Release Notes, Release Announcement.

May 2016 – Firejail is available in Debian jessie-backports.

February 2016 – released Firejail version 0.9.38 (download). The project went through an external security audit, and several SUID-releated problems have been found. Please update your software. This release brings in a number of new features, program interface changes, new application profiles and bugfixes. Release Notes, Release Announcement.

January 2016 – Firejail included in Gentoo Linux.

December 2015 – released Firejail version 0.9.36 (download). This is a bugfix release. It also includes a number of small features. Release Notes.

December 2015 – project moved to a new home!

November 2015 – released Firejail version 0.9.34. This release brings in default home directory whitelisting for Firefox and Chromium, a new seccomp-based security filter (–protocol), dual 32 bit/64 bit seccomp support, support for Skype, Steam and Wine, and a number of smaller features and bugfixes. Release Announcement, Release Notes.

 

External projects based on Firejail

  • Firectl is a tool to integrate Firejail sandboxing in the Linux desktop. Enable Firejail for an application and enjoy a more secure desktop.
  • copr builds (Fedora/CentOS) of the latest version in master git. The executable is installed without SUID bit set, it will work only when the sandbox is started as root. To fix it, run “sudo chmod u+s /usr/bin/firejail”.
  • ansible-firejail – Ansible playbook for Firejail.