3 ms·

Last year, afer a firejail local root exploit got released [0], I've completely quit following their project. I don't want to discomfort the developers and I t

by miduil 8y ago

Last year, afer a firejail local root exploit got released [0], I've completely quit following their project. I don't want to discomfort the developers and I think it's stunning what they are creating... But under the aspect that they are working on a security product, I'm concerned by their overall code quality and testing strategy. They might want to consider taking a step back and reevaluating how they are going to direct their development in terms of secure (c-)coding practices. *Disclaimer: Not a developer, just a sysadmin, but reviewing some of their code/profiles/CI-jobs in their git repo [1] leaves a bad feeling. [0]: https://www.exploit-db.com/exploits/43359/ https://www.exploit-db.com/exploits/43359/ [1]: https://github.com/netblue30/firejail/tree/6830065197cc574898850bb7f2b2f5b214505704 https://github.com/netblue30/firejail/tree/6830065197cc57489...

_emacsomancer_ 8y ago
I have much the same story/experience. Do you use something else in place of firejail?
- miduil 8y ago
  No, I'm still one part of the please don't hack me fraction - still I'm avoiding solution that might improve the security (when seen as layers) a bit. I suppose one should use https://www.qubes-os.org/ https://www.qubes-os.org/.
  - _emacsomancer_ 8y ago
    Qubes seems good, of course, but I've still been looking for less extreme measures.
megous 8y ago
I didn't like the code either. I remember seeing that they were changing euid betwen root and something else all over the place, for seemingly little benfit, because exploit code could simply change it back to root too. It seemed a bit confused. Though there's nsjail if you want something better written/cleaner.
- miduil 8y ago
  Good to read about that you're feeling similar and thank you for the pointer, going to check it out. Sadly this thread never gained traction, but I'd love to read more discussion about this: https://news.ycombinator.com/item?id=13838596 https://news.ycombinator.com/item?id=13838596 (Link for convenience for others) https://github.com/google/nsjail https://github.com/google/nsjail
greenhouse_gas 8y ago
>Last year, afer a firejail local root exploit got released Is it worse than running Firefox without firejail?
- miduil 8y ago
  Well it depends, does your Linux account running Firefox has the possibility to access root (sudo, su)? If yes, I don't know. Maybe a 'strong' apparmor/selinux policy might capture some exploits, firejail tries to mitigate? Other yes, clearly: A Firefox exploit would usually not result in root access (unless it's combined with other Linux exploits) - in the case of firejail, it would have resulted in a root exploit. I'm not saying: Don't use firejail at any cost. But I'm trying to say that you shouldn't have a false confidence in your security, just because you are using firejail and this because their current practices doesn't seem ideal for a security product. At the moment firejail advocates sound like that firejail is 'a proper security solution for Linux desktop', but given the circumstances, it's not. might be worth checking out tor-browser-(bundle?) apparmor profile/s

by miduil 8y ago

_emacsomancer_ 8y ago

I have much the same story/experience. Do you use something else in place of firejail?

miduil 8y ago
No, I'm still one part of the please don't hack me fraction - still I'm avoiding solution that might improve the security (when seen as layers) a bit. I suppose one should use https://www.qubes-os.org/ https://www.qubes-os.org/.
- _emacsomancer_ 8y ago
  Qubes seems good, of course, but I've still been looking for less extreme measures.

megous 8y ago

I didn't like the code either. I remember seeing that they were changing euid betwen root and something else all over the place, for seemingly little benfit, because exploit code could simply change it back to root too. It seemed a bit confused. Though there's nsjail if you want something better written/cleaner.

miduil 8y ago
Good to read about that you're feeling similar and thank you for the pointer, going to check it out. Sadly this thread never gained traction, but I'd love to read more discussion about this: https://news.ycombinator.com/item?id=13838596 https://news.ycombinator.com/item?id=13838596 (Link for convenience for others) https://github.com/google/nsjail https://github.com/google/nsjail

greenhouse_gas 8y ago

>Last year, afer a firejail local root exploit got released Is it worse than running Firefox without firejail?

miduil 8y ago
Well it depends, does your Linux account running Firefox has the possibility to access root (sudo, su)? If yes, I don't know. Maybe a 'strong' apparmor/selinux policy might capture some exploits, firejail tries to mitigate? Other yes, clearly: A Firefox exploit would usually not result in root access (unless it's combined with other Linux exploits) - in the case of firejail, it would have resulted in a root exploit. I'm not saying: Don't use firejail at any cost. But I'm trying to say that you shouldn't have a false confidence in your security, just because you are using firejail and this because their current practices doesn't seem ideal for a security product. At the moment firejail advocates sound like that firejail is 'a proper security solution for Linux desktop', but given the circumstances, it's not. might be worth checking out tor-browser-(bundle?) apparmor profile/s