3 ms·
What I really want is the ability (recipe ?) to chroot a browser. I would like to run 3-4 browsers at all times, each with totally sandboxed identity and IP ad
by rsync 10y ago
What I really want is the ability (recipe ?) to chroot a browser.
I would like to run 3-4 browsers at all times, each with totally sandboxed identity and IP address.
However I do not necessarily want to run a full blown VM for each of them.
This is very simple and efficient for sandboxing server daemons - I do it all the time and there is almost zero overhead involved in chroot/jail. However I have never chrooted a GUI application and cannot find any instances/recipes of anyone chrooting a browser ...
- beagle3 10y agoAre you aware of https://firejail.wordpress.com/ https://firejail.wordpress.com/ ? Sounds like it's what you are looking for (or is there a reason it does not satisfy your requirements?)
- rsync 10y agoThank you - I was not aware of firejail. It appears that this does the things I am looking for - however, I am suspicious - why do we need a new project like this rather than a simple recipe for the existing jail or chroot system calls ? What is it that makes something like firejail necessary ?
- beagle3 10y agoI've run it only once, and I don't really know, but I was under the impression it just took care of setting up bpf syscall filters and namespaces to provide least privilege - which, given neither X not e.g. Firefox was designed to be sandbox, is more complicated than one would expect.