Category Archives: How To

SCIP: Firejail – A Human Tool to Control Software

Securing a computer does not end at the Ethernet port. Once installed and trusted, a piece of code is basically free to access a lot of resources not really necessary (think of X).

This overexposure has become critical with container technology, where the border between the resources and virtual resources may be very confusing.

Using Firejail is a quick-win for each application, especially for browsers without sandboxing. It is easy to use and configure, and the impact on the system is very small.

more

raspberrypi.org: How to install Firejail and sandbox any app

Originally designed to sandbox Firefox, Firejail can sandbox any app, or service (including Google Chrome, Chromium-Browser)

If Firejail is not in your repo, download:

wget http://mirrordirector.raspbian.org/raspbian/pool/main/f/firejail/firejail_0.9.44.8-1_armhf.deb
sudo apt-get install libapparmor1
sudo dpkg -i firejail_0.9.44.8-1_armhf.deb

This version of Firejail (on the repo servers, but not in my Jessie repo “apt-cache search firejail”) must have been compiled with –enable-apparmor as it requires libapparmor1 (which is in the repo).

more

LinuxAndUbuntu: Firejail – A Namespace Separation Security Sandbox

Linux distro is mostly loved for its security features. When we people want more security we use TOR and VPN. Today I am going to tell you about an application called Firejail that helps to protect your personal files via sandbox technique.

Firejail is a sandbox application built for Linux distros which uses the capabilities of Linux kernel to use namespace separation. In the simplest sense, apps launched through Firejail cannot access your personal files on your hard drive. Isn’t that cool? Cool and safe!

Firejail is easy to setup and also very easy to use. You can go either by command line version or UI version. I have got both of them covered. Try anyone you like.

Firejail GUI interface on Linux Mint

Firejail GUI interface on Linux Mint

more

Ars Technica: How to build your own VPN if you’re (rightfully) wary of commercial options

In the wake of this spring’s Senate ruling nixing FCC privacy regulations imposed on ISPs, you may be (even more) worried about how your data is used, misused, and abused. There have been a lot of opinions on this topic since, ranging from “the sky is falling” to “move along, citizen, nothing to see here.” The fact is, ISPs tend to be pretty unscrupulous, sometimes even ruthless, about how they gather and use their customers’ data. You may not be sure how it’s a problem if your ISP gives advertisers more info to serve ads you’d like to see—but what about when your ISP literally edits your HTTP traffic, inserting more ads and possibly breaking webpages?

With a Congress that has demonstrated its lack of interest in protecting you from your ISP, and ISPs that have repeatedly demonstrated a “whatever-we-can-get-away-with” attitude toward customers’ data privacy and integrity, it may be time to look into how to get your data out from under your ISP’s prying eyes and grubby fingers intact. To do that, you’ll need a VPN. more

Linux Mint Sandboxing Guide

 
 

Firejail is an easy to use sandbox that reduces the risk of security breaches by restricting the running environment of untrusted applications using seccomp-bpf and Linux namespaces.

The first seccomp/namespaces sandbox was built by Google for Chromium browser. It was released in 2012, replacing their existing SELinux sandbox. Shiny new technology, the sandbox flew under the radar gaining market share. By 2014 when Firejail project was started, Chromium browser was already running on 50% of Linux desktops. Today there are a small number of projects sandboxing browsers and other desktop applications using seccomp/namespaces technology. We are proud to be one of them.

From the beginning we realized the contradiction between security and comfort, and we made ease of use one of our main goals. We managed to achieve this goal without sacrificing the security functionality. We provide:

  • a simple method to start the sandbox from command line – prefix your application name with “firejail”, eg “firejail firefox”
  • full desktop integration – applications are sandboxed automatically when started by clicking on icons in file manager or desktop manager menus
  • an intuitive syntax for building advanced security profiles
     

    Our focus is GUI application sandboxing, with web browsers being the main target. The sandbox denies access to private files in user’s home directory. Inside the sandbox, Downloads directory and the browser configuration files are real, everything else is stored in a temporary filesystem and later discarded:

    Only Downloads directory is visible inside a sandboxed Firefox browser.

    This guide describes the steps necessary to install and configure Firejail sandbox on Linux Mint. Both Cinnamon and MATE desktop environments are supported. We provide similar support for all desktop managers.

    Continue reading

Joris_VR: Running Steam in Firejail on Debian

Running Steam in Firejail

Running Steam in Firejail

I figured out how to install Steam on Debian 8 (jessie). Not a big deal; lot’s of people have figured it out. In fact steam is available as a non-free Debian package.

However, I prefer to install Steam manually and run it inside Firejail. This article is a reminder to myself, in case I forget how I did it.

Hopefully this information will also be useful to someone else. But I guarantee nothing. This procedure works for me, on my computer, with the few games that I tested. It may or may not work for you. more

Linux Mint: Firejail as security sandbox for your programs

Firejail is an easy to use security sandbox program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux kernel security features. It restricts what files and directories an application can access in your home directory and what access it has to system directories and system resources. Firejail is ideal for use with web browsers, desktop applications, and daemons/servers alike. more