4 ms·

More sandboxing![0] $ firejail --appimage Firefox-*.AppImage For details read Firejail's docs.[1, 2] [0] https://twitter.com/app4soft/status/99493874507283

More sandboxing![0] $ firejail --appimage Firefox-*.AppImage For details read Firejail's docs.[1, 2] [0] https://twitter.com/app4soft/status/994938745072832512 https://twitter.com/app4soft/status/994938745072832512 [1] https://firejail.wordpress.com/documentation-2/appimage-support/ https://firejail.wordpress.com/documentation-2/appimage-supp... [2] https://firejail.wordpress.com/documentation-2/firefox-guide/ https://firejail.wordpress.com/documentation-2/firefox-guide...

miduil 9y ago
Last year, afer a firejail local root exploit got released [0], I've completely quit following their project. I don't want to discomfort the developers and I think it's stunning what they are creating... But under the aspect that they are working on a security product, I'm concerned by their overall code quality and testing strategy. They might want to consider taking a step back and reevaluating how they are going to direct their development in terms of secure (c-)coding practices. *Disclaimer: Not a developer, just a sysadmin, but reviewing some of their code/profiles/CI-jobs in their git repo [1] leaves a bad feeling. [0]: https://www.exploit-db.com/exploits/43359/ https://www.exploit-db.com/exploits/43359/ [1]: https://github.com/netblue30/firejail/tree/6830065197cc574898850bb7f2b2f5b214505704 https://github.com/netblue30/firejail/tree/6830065197cc57489...
- _emacsomancer_ 9y ago
  I have much the same story/experience. Do you use something else in place of firejail?
  - miduil 9y ago
    No, I'm still one part of the please don't hack me fraction - still I'm avoiding solution that might improve the security (when seen as layers) a bit. I suppose one should use https://www.qubes-os.org/ https://www.qubes-os.org/.
    - _emacsomancer_ 9y ago
      Qubes seems good, of course, but I've still been looking for less extreme measures.
- megous 9y ago
  I didn't like the code either. I remember seeing that they were changing euid betwen root and something else all over the place, for seemingly little benfit, because exploit code could simply change it back to root too. It seemed a bit confused. Though there's nsjail if you want something better written/cleaner.
  - miduil 9y ago
    Good to read about that you're feeling similar and thank you for the pointer, going to check it out. Sadly this thread never gained traction, but I'd love to read more discussion about this: https://news.ycombinator.com/item?id=13838596 https://news.ycombinator.com/item?id=13838596 (Link for convenience for others) https://github.com/google/nsjail https://github.com/google/nsjail
- greenhouse_gas 9y ago
  >Last year, afer a firejail local root exploit got released Is it worse than running Firefox without firejail?
  - miduil 9y ago
    Well it depends, does your Linux account running Firefox has the possibility to access root (sudo, su)? If yes, I don't know. Maybe a 'strong' apparmor/selinux policy might capture some exploits, firejail tries to mitigate? Other yes, clearly: A Firefox exploit would usually not result in root access (unless it's combined with other Linux exploits) - in the case of firejail, it would have resulted in a root exploit. I'm not saying: Don't use firejail at any cost. But I'm trying to say that you shouldn't have a false confidence in your security, just because you are using firejail and this because their current practices doesn't seem ideal for a security product. At the moment firejail advocates sound like that firejail is 'a proper security solution for Linux desktop', but given the circumstances, it's not. might be worth checking out tor-browser-(bundle?) apparmor profile/s
muvek 9y ago
I was wondering if there are any benefits (security wise) in using snap firefox (snapcraft.io) instead of firejail. Can anyone comment on this?

miduil 9y ago

Last year, afer a firejail local root exploit got released [0], I've completely quit following their project. I don't want to discomfort the developers and I think it's stunning what they are creating... But under the aspect that they are working on a security product, I'm concerned by their overall code quality and testing strategy. They might want to consider taking a step back and reevaluating how they are going to direct their development in terms of secure (c-)coding practices. *Disclaimer: Not a developer, just a sysadmin, but reviewing some of their code/profiles/CI-jobs in their git repo [1] leaves a bad feeling. [0]: https://www.exploit-db.com/exploits/43359/ https://www.exploit-db.com/exploits/43359/ [1]: https://github.com/netblue30/firejail/tree/6830065197cc574898850bb7f2b2f5b214505704 https://github.com/netblue30/firejail/tree/6830065197cc57489...

_emacsomancer_ 9y ago
I have much the same story/experience. Do you use something else in place of firejail?
- miduil 9y ago
  No, I'm still one part of the please don't hack me fraction - still I'm avoiding solution that might improve the security (when seen as layers) a bit. I suppose one should use https://www.qubes-os.org/ https://www.qubes-os.org/.
  - _emacsomancer_ 9y ago
    Qubes seems good, of course, but I've still been looking for less extreme measures.
megous 9y ago
I didn't like the code either. I remember seeing that they were changing euid betwen root and something else all over the place, for seemingly little benfit, because exploit code could simply change it back to root too. It seemed a bit confused. Though there's nsjail if you want something better written/cleaner.
- miduil 9y ago
  Good to read about that you're feeling similar and thank you for the pointer, going to check it out. Sadly this thread never gained traction, but I'd love to read more discussion about this: https://news.ycombinator.com/item?id=13838596 https://news.ycombinator.com/item?id=13838596 (Link for convenience for others) https://github.com/google/nsjail https://github.com/google/nsjail
greenhouse_gas 9y ago
>Last year, afer a firejail local root exploit got released Is it worse than running Firefox without firejail?
- miduil 9y ago
  Well it depends, does your Linux account running Firefox has the possibility to access root (sudo, su)? If yes, I don't know. Maybe a 'strong' apparmor/selinux policy might capture some exploits, firejail tries to mitigate? Other yes, clearly: A Firefox exploit would usually not result in root access (unless it's combined with other Linux exploits) - in the case of firejail, it would have resulted in a root exploit. I'm not saying: Don't use firejail at any cost. But I'm trying to say that you shouldn't have a false confidence in your security, just because you are using firejail and this because their current practices doesn't seem ideal for a security product. At the moment firejail advocates sound like that firejail is 'a proper security solution for Linux desktop', but given the circumstances, it's not. might be worth checking out tor-browser-(bundle?) apparmor profile/s

muvek 9y ago

I was wondering if there are any benefits (security wise) in using snap firefox (snapcraft.io) instead of firejail. Can anyone comment on this?