3 ms·
Looks interesting but what I don’t understand is if it really is sandboxed, how would a Firefox know that there is another Firefox running and open a tab there
by tetraodonpuffer 6y ago
Looks interesting but what I don’t understand is if it really is sandboxed, how would a Firefox know that there is another Firefox running and open a tab there (as per the FAQ) instead of a new Firefox in a different sandbox?
- pdonis 6y agoThe "sandboxing", as I understand it, only applies to the filesystem; processes can still see other processes run in different firejails if they are being run by the same user.
- tetraodonpuffer 6y agoSure you could see them, after all you can do a ps and see all processes, but shouldn’t the IPC between firejails be forbidden? How is firejail 2 talking to firejail 1?
- jlgaddis 6y ago> ... after all you can do a ps and see all processes ... Which you can prevent by mounting /proc with the "hidepid" option.
- pdonis 6y ago> shouldn’t the IPC between firejails be forbidden? I think it depends on what kind of IPC. I'm not familiar enough with the details of how Firefox does it to know how that would interact with firejails.
- trulyrandom 6y agoUnless not possible due to requirements of a specific program, firejails have their own PID namespace and can only see themselves.
- wilt 6y agoIt is because of user namespaces. I assume you can tell firejail to use seperate ones with some commandline switches.