Linux Mint Sandboxing Guide

 

Contents

• Installing and configuring Firejail
• Running applications
• Installing new programs
• Desktop launchers
• Docks
• Conclusion

 

Firejail is an easy to use sandbox that reduces the risk of security breaches by restricting the running environment of untrusted applications using seccomp-bpf and Linux namespaces.

The first seccomp/namespaces sandbox was built by Google for Chromium browser. It was released in 2012, replacing their existing SELinux sandbox. Shiny new technology, the sandbox flew under the radar gaining market share. By 2014 when Firejail project was started, Chromium browser was already running on 50% of Linux desktops. Today there are a small number of projects sandboxing browsers and other desktop applications using seccomp/namespaces technology. We are proud to be one of them.

From the beginning we realized the contradiction between security and comfort, and we made ease of use one of our main goals. We managed to achieve this goal without sacrificing the security functionality. We provide:

• a simple method to start the sandbox from command line – prefix your application name with “firejail”, eg “firejail firefox”
• full desktop integration – applications are sandboxed automatically when started by clicking on icons in file manager or desktop manager menus
• an intuitive syntax for building advanced security profiles
 

Our focus is GUI application sandboxing, with web browsers being the main target. The sandbox denies access to private files in user’s home directory. Inside the sandbox, Downloads directory and the browser configuration files are real, everything else is stored in a temporary filesystem and later discarded:



Only Downloads directory is visible inside a sandboxed Firefox browser.

This guide describes the steps necessary to install and configure Firejail sandbox on Linux Mint. Both Cinnamon and MATE desktop environments are supported. We provide similar support for all desktop managers.

 

Installing and configuring Firejail

Download the latest Firejail .deb package from our Download page and run the following three commands in a terminal:

$ sudo dpkg -i firejail_0.9.46_1_amd64.deb
$ firecfg --fix-sound
$ sudo firecfg

The first command installs Firejail software. The second command solves some shared memory/PID namespace bugs in PulseAudio software prior to version 9. The third command integrates Firejail into your desktop. You would need to logout and login back to apply PulseAudio changes.

 

Running applications

Start your programs the way you are used to: desktop manager menus, file manager, desktop launchers. The integration applies to any program supported by default by Firejail. There are more than 1000 default applications in Firejail version 0.9.64, and the number goes up with every new release. We keep the list in /usr/lib/firejail/firecfg.config file.

Just for fun, start several programs by clicking your desktop manager menus, then open a terminal and run the following command:

$ firejail --top

This command tells you what programs are running in a Firejail sandbox. If your program was not sandboxed automatically, use the old method of prefixing your program with “firejail” command:

$ firejail program-name


firejail –top

 

Installing new programs

Run sudo firecfg every time you install a new program, here is a Chromium browser example:

$ sudo apt-get install chromium-browser
$ sudo firecfg


Only Downloads directory is visible inside a sandboxed Chromium browser.

 

Desktop launchers

Cleaning up my software archive, I run into an old copy of Pentix. This is a very addictive Tetris clone I used to play in a DOS window way back when computers used to be fun. I created a directory pentix in my home and copied the game there. The next step was to go in Desktop directory and create a launcher for the game. The launcher is a regular text file with the following content:

[Desktop Entry]
Type=Application
Name=Pentix
Icon=/home/netblue/pentix/pentix.png
Exec=dosbox /home/netblue/pentix/pentix.exe
Terminal=false

I use dosbox emulator (sudo apt-get install dosbox) to run the game. Firejail will sandbox the emulator automatically with a proper security profile. The icon pentix.png is something I grabbed from a clipart website. First time I click on the icon, a very annoyed Cinnamon tells me the launcher is not marked as trusted. I press “Mark as trusted” and get on with the game.



A sandboxed Pentix game.

Docks

The Linux desktop can also be customized using docks. A dock is a toolbar-like application launcher holding icons for frequently used programs. Docks are highly configurable and many users find them useful and beautiful.

Several docks are available in Mint repositories. Among them Plank (sudo apt-get install plank), Docky (sudo apt-get install docky) and Cairo (sudo apt-get install cairo-dock). Similar to the regular desktop launchers, clicking on icons will sandbox applications automatically.



Cairo dock starting sandboxed programs.

Conclusion

Firejail is a must have tool for security concerned users. Like Mint, Firejail is a community project. We are not affiliated with any corporation, and pursue the user’s interest. If you run into problems, have new ideas, feature requests, whatever, join us on our development page. Thank you for reading!

More info:

• Securely Run Programs In Linux Mint Using Firetools
• Linux Mint: Firejail as security sandbox for your programs