About

Whitelisted home directory in Mozilla Firefox

Whitelisted home directory in Mozilla Firefox

Firejail is a SUID program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces and seccomp-bpf. It allows a process and all its descendants to have their own private view of the globally shared kernel resources, such as the network stack, process table, mount table.

Written in C with virtually no dependencies, the software runs on any Linux computer with a 3.x kernel version or newer. The sandbox is lightweight, the overhead is low. There are no complicated configuration files to edit, no socket connections open, no daemons running in the background. All security features are implemented directly in Linux kernel and available on any Linux computer. The program is released under GPL v2 license.

Firejail can sandbox any type of processes: servers, graphical applications, and even user login sessions. The software includes security profiles for a large number of Linux programs: Mozilla Firefox, Chromium, VLC, Transmission etc. To start the sandbox, prefix your command with “firejail”:

$ firejail firefox                       # starting Mozilla Firefox
$ firejail transmission-gtk              # starting Transmission BitTorrent 
$ firejail vlc                           # starting VideoLAN Client
$ sudo firejail /etc/init.d/nginx start  # starting nginx web server

We also develop a graphical user interface, Firetools. Distributed as a separate package, the application is built using Qt4/Qt5 libraries. It provides a sandbox launcher integrated with the system tray, sandbox editing, management and statistics.

 

 

Screenshots

Firetools: launcher and sandbox stats

Firetools: launcher and sandbox stats

 

News

March 2017 – released Firejail 0.9.44.10 (Download). This is a regular bugfix-only maintenance release. Release Notes.

February 2017 – released Firetools 0.9.46 (Download). This release brings in a number of bugfixes and general enhancements, and a simple configuration wizard for Firejail sandbox – firejail-ui.

January 2017 – released Firejail 0.9.44.8 (Download). This release fixes the sound problems introduced a few days ago in 0.9.44.6. Most PulseAudio users were affected by the bug. Somehow ALSA users were not affected.

January 2017 – released Firejail 0.9.38.10 (Download). This is a security release, please update the software. Release Notes.

January 2017 – released Firejail 0.9.44.6 (Download). This is a security release, please update the software. Release Notes.

January 2017 – released Firejail 0.9.38.8 (Download). This is a security release, please update the software. Release Notes.

January 2017 – released Firejail 0.9.44.4 (Download). This is a security release, please update the software. Release Notes.

December 2016 – released Firejail 0.9.38.6 (Download). This is a maintenance release on our Long Term Support (LTS) branch, fixing a number of small bugs.

December 2016 – released Firejail 0.9.44.2 (Download). This is a maintenance and security release for version 0.9.44. We strongly encourage you to update the software. Release Notes.

October 2016 – released Firetools 0.9.44 (download). This is a bugfix release.

October 2016 – released Firejail 0.9.44 (Download). This release brings in support for sandboxing applications using the untrusted mode implemented by X11 security extension (–x11=xorg), support for blocking access to X11 system (–x11=none), NVIDIA drivers support when using –private-dev feature, X11 detection support for audit feature, assigning names to veth interfaces, disable 3D hardware acceleration (–no3d), support for moving files in and out of the sandbox (–put), a large number of new security profiles and bugfixes. Release Notes.

October 2016 – released Firejail LTS version 0.9.38.4 (Download). This is a bugfix release on our long term support branch. Release Notes.

September 2016 – released Firejail version 0.9.42 (download). This release brings in AppImage support, AppArmor support, sandbox auditing, –private-home feature was brought back, and a number of smaller features and bug fixes. The development team identified and fixed several potential security failures. The fixes have also been backported to our Long Term Support branch based on release 0.9.38, please update the software. Release Notes, Release Announcement.

August 2016 – released Firejail version 0.9.38.2 (Download). Firejail Long Term Support (LTS) branches extend the life of regular Firejail releases to at least 2 years. This is the first LTS release for version 0.9.38. The release includes security fixes, bug fixes, and small features. Release Notes

June 2016 – released Firetools version 0.9.40.1 (download). This is a bugfix release.

May 2016 – released Firetools version 0.9.40 (download). This release includes Grsecurity support, protocols, cup cores, sandbox name and X11 sandboxing support in the stats section, and a number of updates and bug fixes. A file manager that allows the user to browse the filesystem inside the sandbox is also included in this release.

May 2016 – released Firejail version 0.9.40 (download). This release includes a number of major features, such as X11 sandboxing support, file transfers between sandboxes and the host system, run-time configuration support, AppArmor and Grsecurity support, and firecfg, a desktop configuration utility. A number of smaller features, documentation and bugfixes are also included. Release Notes, Release Announcement.

 

External projects