Linux has a reputation of being fairly secure, and out of the big three operating systems it runs into far less issues when it comes to privacy. Still, as secure as Linux can be, there’s always room for improvement. The app is the most popular program sandboxing tool on Linux. It is because of this, many Linux distributions have decided to ship this software.
And so I remembered something I’ve considered many times before regarding root and security in Linux (but also other operating systems): I actually don’t care about root access.
Sure, it would be annoying to reinstall my system if a program were to mess with the system files. But the only thing I really care about are my personal files. And ANY program I run could read all my files (privacy, and other secrets) and encrypt or simply destroy them all. That is what I care about – and there is no security for this at all – but instead I’m being pestered about root access, which really doesn’t matter to me. I might also care about access to my camera, or what programs are talking to the internet, etc.
Authorization (from xkcd.com)
We are proud to announce the release of Parrot 3.10, the latest version of our security oriented GNU/Linux distribution.
The first big news is the introduction of a full firejail+apparmor sandboxing system to proactively protect the OS by isolating its components with the combination of different techniques. The first experiments were already introduced in Parrot 3.9 with the inclusion of firejail, but we took almost a month of hard work to make it even better with the improvement of many profiles, the introduction of the apparmor support and enough time to make all the tests.
Nowadays security threats are everywhere in the web, new security holes are discovered everyday, but sadly there are no instant patches available. If you are a firefox user, this problem is worse, as it lacks the sandbox feature like chromium or Google chrome browser.
Here’s how to protect yourself from such threats by running firefox in sandbox environment with firejail.
Firejail is an extremely lightweight Linux namespace based sandbox application, could be used with both GUI and CLI applications with minimal effort. Firejail could do even more, like traffic shaping, application spacific DNS server and default gateway etc. etc.
It could effectively run most apps with limited permission and system resource to minimize security risk. There’s also a GUI app firetools , to launch and monitor apps with firejail.
Network bandwidth shaping or traffic shaping is extensively used for efficient use of available network bandwidth and fairer bandwidth sharing.
Most common use of bandwidth shaping in Linux desktop is fair bandwidth sharing among different application, assume your torrent client is eating all download speed while browsing something important. For servers, it’s a lot more complex and important subject.
Surely firejail is not the best tool for this purpose, there are other utilities like iptables and tc token bucket filter. But why not use the handy firejail tool ?
For new comers, firejail is an extremely lightweight tool for isolating one/many application from the rest of the system, more straightly a sandbox application, read more about sandboxing apps with firejail here. So using fireail for traffic shaping adds an extra layer of security. Lets start !
One thing I that like about the Android App security model is that for a given app, it presents the permissions to the user and the user has to accept them. This is good because the user has control over the software it runs, and is an invaluable tool to be able to use an App without granting it too much access without having to renounce to use it altogether.
Fortunately, the Linux world is a much more friendly environment in terms of malicious software. A big reason for this, is the fact that software is audited and curated by distro package maintainers. I recommend this interesting post on the subject.
Even the best written software can contain vulnerabilities that can be exploited. With the advent of container technologies, such as docker, flatpak or LXC, many have suggested to use them to isolate software from the rest of the system and in doing so mitigate the harm of possible breaches.
By sandboxing software this way, you get some more control over what it is capable of doing, effectively getting closer to the Android security model.
Sandboxing uses isolation technology to separate programs from your underlying operating system preventing unwanted changes from happening to your personal data, programs and applications that rest safely on your hard drive.