3 ms·
Why no mention of firejail or similar tools? Sandboxing applications is an excellent way to minimize risks. And firejail comes with a long set of default rules
by nextos 7y ago
Why no mention of firejail or similar tools?
Sandboxing applications is an excellent way to minimize risks. And firejail comes with a long set of default rules that make it easy to use without any configuration.
- danieldk 7y agoWhy no mention of firejail or similar tools? They do mention bubblewrap in the sandbox-app-launcher section.
- madaidan 7y agoFirejail has far too large attack surface and is suid root which has resulted in plenty of privilege escalation vulnerabilities. https://seclists.org/oss-sec/2017/q1/25 https://seclists.org/oss-sec/2017/q1/25 https://www.cvedetails.com/vulnerability-list.php?vendor_id=16191&product_id=0 https://www.cvedetails.com/vulnerability-list.php?vendor_id=... Also see this thread https://github.com/netblue30/firejail/issues/3046 https://github.com/netblue30/firejail/issues/3046 Instead, we're going to use bubblewrap which is similar but with minimal attack surface. See the sandbox-app-launcher section of the post.