3 ms·
+1 for firejail. I cannot even imagine running a browser without putting it in a sandbox.
by craftyguy 8y ago
+1 for firejail. I cannot even imagine running a browser without putting it in a sandbox.
- blibble 8y agochrome runs in a sandbox though, using the same techniques as firejail https://chromium.googlesource.com/chromium/src/+/HEAD/docs/linux_sandboxing.md https://chromium.googlesource.com/chromium/src/+/HEAD/docs/l...
- craftyguy 8y agoApparently not the same technique since this CVE is a thing that allows access to user files. The only thing I've permitted the browser on my computer to 'see' in ~/ is a 'Downloads' directory. When I open 'file:///home/craftyguy' in the browser, it's literally the only thing it sees. Furthermore, it can write whatever it wants to ~/, but that's just a tmpfs filesystem that goes away when the process dies.