Sandboxing with Firejail

Secure Play

Article from Issue 189/2016
Author(s):

Firejail makes sandboxing as easy as typing eight letters in front of a command.

Sandboxing [1], or isolating processes and applications in their own environment, is a long-established practice in Linux. Unfortunately, although it is efficient, it can be difficult to configure and use. Even containers and virtual machines have not improved the process much, because they are only as secure as their configuration. What makes Firejail [2] so different is that it makes sandboxing easy and can do far more if you are willing to learn how to configure it. This simplicity has made Firejail the center of attention in less than a year.

Firejail is a structural security solution; it is configured to prevent intrusions rather than react to them the way an antivirus program does. Instead of adding daemons and other applications, it works by creating a restricted environment with its own set of solutions, running within user space and using features that are already a part of the Linux kernel, such as seccomp-bpf [3]. The result is sandboxing that requires far fewer system resources than traditional solutions, such as creating a chroot jail [4], and is easy to customize.

In fact, Firejail installs with 64 security profiles for popular applications, ranging from Firefox and KMail to XChat and Wine, as well as a generic profile used automatically for applications and processes that lack a custom profile (Figure 1). All profiles use a basic syntax with one item per line that can easily be learned by studying the profiles that are installed along with the command (Figure 2).

[...]

Use Express-Checkout link below to read the full article (PDF).

Buy this article as PDF

Download Article PDF now with Express Checkout
Price $2.95
(incl. VAT)

Buy Linux Magazine

SINGLE ISSUES
Print Issues
Digital Issues
SUBSCRIPTIONS
Print Subscriptions
Digital Subscriptions

Related content

  • Firejail

    Firejail enhances security by isolating programs and processes in separate jails and thus regulating access to the filesystem.

    more »
  • Laptop Security

    Linux is quite secure compared to the alternatives, but you'll need a few additional steps if you really want to lock it down. We'll introduce you to some practical tools for antivirus protection, firewall configuration, and sandboxing.

    more »
  • strace and Firejail

    Software from unknown sources always poses some risks. With the strace analysis tool and the Firejail sandbox, you can monitor and isolate unknown applications to safeguard your system.

    more »
  • Universal Package Formats

    Modern-day package systems solve some problems posed by classic formats like DEB and RPM. We look at Flatpak, AppImage, and Snap and describe how they differ.

    more »
  • FOSSPicks

    As you might guess from certain titles in this month's selection, Graham has finally built himself an open source 3D printer.

    more »
comments powered by Disqus
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters

Support Our Work

Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.

Learn More

News

Tag Cloud

Administration Community Desktop Events Hardware Linux Mobile Programming Security Software Ubuntu Web Development Windows free software open source