About

Whitelisted home directory in Mozilla Firefox

Whitelisted home directory in Mozilla Firefox

Firejail is a SUID program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces and seccomp-bpf. It allows a process and all its descendants to have their own private view of the globally shared kernel resources, such as the network stack, process table, mount table.

Written in C with virtually no dependencies, the software runs on any Linux computer with a 3.x kernel version or newer. The sandbox is lightweight, the overhead is low. There are no complicated configuration files to edit, no socket connections open, no daemons running in the background. All security features are implemented directly in Linux kernel and available on any Linux computer. The program is released under GPL v2 license.

Firejail can sandbox any type of processes: servers, graphical applications, and even user login sessions. The software includes security profiles for a large number of Linux programs: Mozilla Firefox, Chromium, VLC, Transmission etc. To start the sandbox, prefix your command with “firejail”:

$ firejail firefox                       # starting Mozilla Firefox
$ firejail transmission-gtk              # starting Transmission BitTorrent 
$ firejail vlc                           # starting VideoLAN Client
$ sudo firejail /etc/init.d/nginx start  # starting nginx web server

We also develop a graphical user interface, Firetools. Distributed as a separate package, the application is built using Qt4/Qt5 libraries. It provides a sandbox launcher integrated with the system tray, sandbox editing, management and statistics.

 

 

Development

Firejail is a community project. We are not affiliated with any company, and we don’t have any commercial goals. Our focus is the Linux desktop. Home users and Linux beginners are our target market. The software is built by a large international team of volunteers on GitHub. Expert or just a regular Linux user, you are welcome to join us!

 

 

News

September 2018 – released Firejail 0.9.56 (Download). New features: wireless interface support for –net command, tunneling support (TAP device support in –net command), temporary filesystem support for /home/user/.cache directory (–private-cache), support for U2F devices, additional hardening of SUID executable, and much more. Release Notes.

May 2018 – released Firejail 0.9.54 (Download). This release includes a number of new features and new profiles. Firefox 60 problems seem to be fixed for now. Trying to mitigate the concerns about Firejail being an SUID application, we introduce Firejail Access Database. This is basically a list of users that are allowed to use the sandbox. The list is located in /etc/firejail/firejail.users file. After updating to the new version you should execute sudo firecfg which not only applies the newly introduced profiles but also adds the current user to the database. Release Notes.

May 2018 – in response to Firefox 60 breaking security profiles in Firejail, we are starting tracking profile fixes for various Firejail versions out in the field. See our Support page for more details.

May 2018 – released Firejail 0.9.54~rc2 (Download) – emergency fix for Firefox browser. Firefox version 60 released by Mozilla a few days ago is breaking the existing Firejail security profile. For some users Firefox will refuse to start, or it will fail to display any web pages.

May 2018 – released Firejail 0.9.54~rc1 (Download) the first test release in 0.9.54 series. This is a huge release, with lots of new features, new application profiles, and general SUID hardening. Release Notes.

March 2018 – released Firetools 0.9.52 (Download). In this release we switch to a more pleasant grayscale color scheme, we introduce a number of small enhancements, and regular bugfixes. Release Notes.

December 2017 – released Firejail 0.9.52 (Download). The main feature in this release is a profile builder. Run “firejail –build program-name” and it will print in your terminal a very restrictive whitelisted profile for your application. A whitelisted seccomp filter is also extracted. You can use the resulting profile as a starting point when building your own profiles. There are also several other enhancements, a lot of new application profiles, and quite a number of bug fixes.Release Notes.

November 2017 – released Firejail 0.9.44.12 (Download). This is a regular bugfix-only maintenance release on our long-term support (LTS) branch. Release Notes.

October 2017 – released Firetools 0.9.50. This release introduces a number of GUI enhancements and bugfixes. Firejail version 0.9.50 or newer is required in order to run this release. Release Notes.

September 2017 – released Firejail 0.9.50. This release introduces a number of small features, –private-lib support, support for Xpra versions 2.x, a redesign of seccomp subsystem, lost of new application profiles, and bugfixes. Release Notes.

 

External projects

Firejail

Firejailed!

  • Firewarden is a bash script used to open a program within a private Firejail sandbox.
  • Firejail Profile Generator
  • Ansible role to setup Firejail
  • firejail-extras: Arch Linux AUR package containing extra security profiles for Firejail
  • https://github.com/chiraag-nataraj/firejail-profiles – This is a collection of tighter security profiles maintained by a Firejail contributor.
  • Firejail package on SlackBuilds.org
  • Firectl is a tool to integrate Firejail sandboxing in the Linux desktop. Enable Firejail for an application and enjoy a more secure desktop.
  • copr builds (Fedora/CentOS) of the latest version in master git. The executable is installed without SUID bit set, it will work only when the sandbox is started as root. To fix it, run “sudo chmod u+s /usr/bin/firejail”.
  • ansible-firejail – Ansible playbook for Firejail.
Advertisements