About

Whitelisted home directory in Mozilla Firefox

Whitelisted home directory in Mozilla Firefox

Firejail is a SUID program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces and seccomp-bpf. It allows a process and all its descendants to have their own private view of the globally shared kernel resources, such as the network stack, process table, mount table.

Written in C with virtually no dependencies, the software runs on any Linux computer with a 3.x kernel version or newer. The sandbox is lightweight, the overhead is low. There are no complicated configuration files to edit, no socket connections open, no daemons running in the background. All security features are implemented directly in Linux kernel and available on any Linux computer. The program is released under GPL v2 license.

Firejail can sandbox any type of processes: servers, graphical applications, and even user login sessions. The software includes security profiles for a large number of Linux programs: Mozilla Firefox, Chromium, VLC, Transmission etc. To start the sandbox, prefix your command with “firejail”:

$ firejail firefox                       # starting Mozilla Firefox
$ firejail transmission-gtk              # starting Transmission BitTorrent 
$ firejail vlc                           # starting VideoLAN Client
$ sudo firejail /etc/init.d/nginx start  # starting nginx web server

We also develop a graphical user interface, Firetools. Distributed as a separate package, the application is built using Qt4/Qt5 libraries. It provides a sandbox launcher integrated with the system tray, sandbox editing, management and statistics.

 

 

News

September 2017 – released Firejail 0.9.50. This release introduces a number of small features, –private-lib support, support for Xpra versions 2.x, a redesign of seccomp subsystem, lost of new application profiles, and bugfixes. Release Notes.

June 2017 – released Firejail 0.9.48. This is mainly a bugfix release, with a small number of new features and new security profiles. Release Notes.

May 2017 – released Firejail 0.9.46. The main feature introduced in this release is full desktop integration for Cinnamon, KDE, LXDE/LXQT, MATE and XFCE desktop managers, and partial support for GNOME Shell and Unity. This allows the user to sandbox programs automatically by clicking on desktop manager menus, desktop launchers, and files in file manager. The integration is set up by running “sudo firecfg” after installing the software. For more information, check out our Linux Mint Sandboxing Guide or consult the documentation. This release also brings in quite a number of new features, bugfixes and new security profiles. Release Notes.

March 2017 – released Firejail 0.9.44.10 (Download). This is a regular bugfix-only maintenance release. Release Notes.

February 2017 – released Firetools 0.9.46 (Download). This release brings in a number of bugfixes and general enhancements, and a simple configuration wizard for Firejail sandbox – firejail-ui.

January 2017 – released Firejail 0.9.44.8 (Download). This release fixes the sound problems introduced a few days ago in 0.9.44.6. Most PulseAudio users were affected by the bug. Somehow ALSA users were not affected.

 

External projects

Firejail

Firejailed!

  • Firewarden is a bash script used to open a program within a private Firejail sandbox.
  • Firejail Profile Generator
  • Ansible role to setup Firejail
  • firejail-extras: Arch Linux AUR package containing extra security profiles for Firejail
  • https://github.com/chiraag-nataraj/firejail-profiles – This is a collection of tighter security profiles maintained by a Firejail contributor.
  • Firejail package on SlackBuilds.org
  • Firectl is a tool to integrate Firejail sandboxing in the Linux desktop. Enable Firejail for an application and enjoy a more secure desktop.
  • copr builds (Fedora/CentOS) of the latest version in master git. The executable is installed without SUID bit set, it will work only when the sandbox is started as root. To fix it, run “sudo chmod u+s /usr/bin/firejail”.
  • ansible-firejail – Ansible playbook for Firejail.
Advertisements