Whitelisted home directory in Mozilla Firefox

User home directory as seen by Mozilla Firefox browser process

Firejail is a SUID program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces and seccomp-bpf. It allows a process and all its descendants to have their own private view of the globally shared kernel resources, such as the network stack, process table, mount table.

Written in C with virtually no dependencies, the software runs on any Linux computer with a 3.x kernel version or newer. The sandbox is lightweight, the overhead is low. There are no complicated configuration files to edit, no socket connections open, no daemons running in the background. All security features are implemented directly in Linux kernel and available on any Linux computer. The program is released under GPL v2 license.

Firejail can sandbox any type of processes: servers, graphical applications, and even user login sessions. The software includes security profiles for a large number of Linux programs: Mozilla Firefox, Chromium, VLC, Transmission etc. To start the sandbox, prefix your command with “firejail”:

$ firejail firefox                       # starting Mozilla Firefox
$ firejail transmission-gtk              # starting Transmission BitTorrent 
$ firejail vlc                           # starting VideoLAN Client
$ sudo firejail /etc/init.d/nginx start  # starting nginx web server



Available Software Packages

We offer two Firejail flavors (mainline and long term support) and a number of additional sandbox plug-ins.

    • Mainline is our latest and greatest sandbox version. It includes new features and developments, updated profiles, and support for the latest desktop applications. The target audience is desktop home users. (development page
    • Long Term Support (LTS) – Every two or three years we cut a branch from mainline git, we remove rarely used features (chroot, overlay, rlimits, cgroups, etc.), incomplete features (private-bin, private-lib, etc.), and a lot of instrumentation (build profile feature, tracing, auditing, etc). Sandbox-specific security features such as seccomp, capabilities, filesystem whitelist/blacklist and networking are updated and hardened. LTS receives periodic security updates, but no new features are ever added. The end result is a more stable software base, and a much smaller attack surface. Please use this version for any kind of enterprise deployment. (development page
    • Firetools is the graphical user interface of Firejail. The application is built using Qt4/Qt5 libraries. It provides a sandbox launcher integrated with the system tray, sandbox editing, management and statistics. (project webpage, development page
    • FDNS is a DNS over HTTPS (DoH) proxy server. FDNS protects your computer against some of the most common cyber threats, all while improving the privacy and the system performance. We use only DoH services from non-logging providers, while preferring small operators such as open-source enthusiasts and privacy-oriented non-profit organizations. (project webpage, development page)
    • Firetunnel allows the user to connect multiple Firejail sandboxes on a virtualized Ethernet network. Applications include virtual private networks (VPN), overlay networks, peer-to-peer applications. Currently the project is in beta-testing phase, you can find out more on our development page. 

    Technology Presentation – DJ Ware YouTube Channel


    About Us

    Firejail is a community project. We are not affiliated with any company, and we don’t have any commercial goals. Our focus is the Linux desktop. Home users and Linux beginners are our target market. The software is built by a large international team of volunteers on GitHub. Expert or regular Linux user, you are welcome to join us!

    Security bugs are taken seriously, please email them to netblue30 at protonmail.com.



    June 2021 – Firejail 0.9.66 released: lots of new features; rework of some of the most important modules and lots of hardening; a new tool, jailcheck, that allows the user to quickly asses the security of user installed applications; new application security profiles and updates. Release Notes

    May 2021 – released Firejail DNS Proxy Server (FDNS) 0.9.66. This release brings in support for a servers.local file in etc directory, added several new commands for server file, new command line options, a new utility program (nxdomain) to clean up expired adblocker domains, removed non-profit tag from the server list, and lots of bug fixes. The adblocker filter and the server list have been updated. FDNS packages are currently available in Arch Linux (AUR) and Slackware (Slackbuilds). Release Notes

    Security Advisory – Feb 8, 2021




    Summary: A vulnerability resulting in root privilege escalation was discovered in Firejail’s OverlayFS code,

    Versions affected: Firejail software versions starting with 0.9.30. Long Term Support (LTS) Firejail branch is not affected by this bug.

    Workaround: Disable overlayfs feature at runtime. In a text editor open /etc/firejail/firejail.config file, and set “overlayfs” entry to “no”.

    $ grep overlayfs /etc/firejail/firejail.config
    # Enable or disable overlayfs features, default enabled.
    overlayfs no

    Fix: The bug is fixed in Firejail version

    GitHub commit: (file configure.ac)

    Credit: Security researcher Roman Fiedler analyzed the code and discovered the vulnerability. Functional PoC exploit code was provided to Firejail development team. A description of the problem is here on Roman’s blog:



    February 2021 – released Firejail fixing the privilege escalation bug in OverlayFS (Release Notes).

    January 2021 – released Firejail, a maintenance release bringing in a small number of features, new profiles, and bugfixes (Release Notes).

    January 2021 – released Firetools 0.9.64 (Download, Release Notes) and FDNS (Download, Release Notes).

    October 2020 – released Firejail DoH Proxy Server (FDNS) version 0.9.64 (Download), featuring a number of new command line options, monitor enhancements, server list updates and bug fixes. Starting with this release, AppArmor is supported in Arch Linux. Release Notes

    October 2020 – released Firejail 0.9.64. In this release we introduce SELinux labeling support, fine-grained D-Bus sandboxing with xdg-dbus-proxy, custom 32-bit seccomp filter support, whitelist globbing, mkdir and mkfile support for /run/user directory, and a number of new command line options. The blocking action of seccomp filters has been changed from killing the process to returning EPERM to the caller. On the network side we are introducing DHCP support, and integration with FNDS, our own DNS over HTTPS proxy handled for now as a separate plug-in. There are also lots of bug fixes and additional code hardening, and the number of supported applications supported by default grew over 1000. (Release Notes).

    September 2020 – released FDNS (Download). In this release we are adding support for DNS over TLS and HTTP 1.1, restructure geographical zones, keepalive timer randomization, server list updates and bugfixes. Release Notes

    August 2020 – released Firejail (Download). This release fixes an AppArmor problem on Arch Linux distribution introduced in the previous release. (Release Notes).

    August 2020 – released Firejail (Download). This release fixes two security vulnerabilities (CVE-2020-17367 and CVE-2020-17368) and a number of bugs. LTS version is not affected. (Release Notes).

    March 2020 – documentation: Firejail BitTorrent Sandboxing Guide

    March 2020 – released FDNS In this release we introduce CNAME cloaking protection, DNS rebinding protection, SNI cloaking whenever possible, we disable all known DoH service on the local network, and we increased DNS cache TTL to 40 minutes. Also bugfixes and a DoH server list update. more…

    Feruary 2020 – released FDNS The project is feature-complete! We added over 60 new DNS over HTTPS servers, documentation, an automated test framework, and lots of bugfixes. You can find the project here.

    December 2019 – released Firejail 0.9.62 (Download) with a number of new features, additional SUID hardening, lots of bugfixes, and a large number of new applications supported by default. Basically, during 2019 we doubled the number of default apps, and we stand now at 884. This number will go way up in 2020. Happy New Year! (Release Notes).

    additional hardening, a small number of new features

    December 2019 – released Firetools 0.9.62 (Download). In this release we introduce support for Firejail DNS over HTTPS proxy server (fdns), a separate system tray icon to control the stats application, the network statistics were enhanced and split out in a separate window, support for our Firejail LTS release, and a number of bugfixes. (Release Notes)

    We also have a new webpage for the project at https://firejailtools.wordpress.com.

    December 2019 – We are proud to announce a new addition to the Firejail family of security tools: Firejail DNS over HTTPS proxy server.
    Targeted at small networks and Linux desktops, the proxy adds strong encryption and authentication on top of the regular DNS protocol. You can run it as a regular DNS server for a network of computers, or as a plug-in for your Firejail sandboxes. The software is written in C, and is licensed under GPLv3.

    June 2019 – released Firejail (Download). This a regular bugfix-only release for our LTS branch (Release Notes). This version also fixes two security issues, details here.

    May 2019 – released Firejail 0.9.60 (Download). This release brings in a several new features, lots of new application profiles, bugfixes and general SUID hardening (Release Notes). This version also fixes two security issues, details here.

    February 2019 – released Firejail (Download). In this release we are fixing a number of bugs introduced by 0.9.58. Release Notes.

    January 2019 – released Firejail 0.9.58 (Download). This is a maintenance release including bugfixes and security profile updates for over 600 Linux applications. Release Notes.

    January 2019 – released Firetools 0.9.58 (Download). Release Notes.

    October 2018 – released Firejail LTS 0.9.56 (Download). We are rebasing our Long Term Support branch of Firejail. The previous LTS version (0.9.38.x) is more than two years old. The new version updates the code base to 0.9.56. We target a reduction of approx. 40% of the code by removing rarely used features (chroot, overlay, rlimits, cgroups), incomplete features (private-bin, private-lib), and a lot of instrumentation (build profile feature, tracing, auditing, etc). Sandbox-specific security features such as seccomp, capabilities, filesystem whitelist/blacklist and networking are updated and hardened. Release Notes.

    September 2018 – released Firejail 0.9.56 (Download). New features: wireless interface support for –net command, tunneling support (TAP device support in –net command), temporary filesystem support for /home/user/.cache directory (–private-cache), support for U2F devices, additional hardening of SUID executable, and much more. Release Notes.

    May 2018 – released Firejail 0.9.54 (Download). This release includes a number of new features and new profiles. Firefox 60 problems seem to be fixed for now. Trying to mitigate the concerns about Firejail being an SUID application, we introduce Firejail Access Database. This is basically a list of users that are allowed to use the sandbox. The list is located in /etc/firejail/firejail.users file. After updating to the new version you should execute sudo firecfg which not only applies the newly introduced profiles but also adds the current user to the database. Release Notes.

    March 2018 – released Firetools 0.9.52 (Download). In this release we switch to a more pleasant grayscale color scheme, we introduce a number of small enhancements, and regular bugfixes. Release Notes.


    External projects



    • HOWTO: Firejailed Tor Browser
    • fjp is a handy command line program to work fast and straightforward with firejail profiles.
    • Fireinvoke is a program that allows to easily run appimages and programs extracted from archives in the firejail sandbox by running simple command or by just double clicking it in file manager.
    • fire-install installs programs from archives and appimages into ~/.programs and creates launchers in ~/.local/bin. The programs are executed with fireinvoke.
    • Firewarden is a bash script used to open a program within a private Firejail sandbox.
    • Ansible role to setup Firejail
    • firejail-extras: Arch Linux AUR package containing extra security profiles for Firejail
    • https://github.com/chiraag-nataraj/firejail-profiles – This is a collection of tighter security profiles maintained by a member of Firejail development team.
    • Firejail package on SlackBuilds.org
    • ansible-firejail – Ansible playbook for Firejail.