3 ms·

Have you looked at Firejail? It presents several options to contain applications, working on existing packages and AppImages. You could see it as a more easily

Have you looked at Firejail? It presents several options to contain applications, working on existing packages and AppImages. You could see it as a more easily configured verfsion of the security parts of Flatpaks without the application parts. https://firejail.wordpress.com/ https://firejail.wordpress.com/

zxzax 5y ago
Firejail can easily suffer from some of the same issues, if it's not configured properly. Some of the issues listed here are not specific to Flatpak, and need to be addressed with any sandboxing mechanism.
- eikenberry 5y ago
  Firejail is a tool, and a pretty nice one. But it isn't simple to use yet. But with support for using overlay filesystems for home or root, combined with cgroups isolation and it covers the issues that site brings up.
  - zxzax 5y ago
    Flatpak handles all that too, all these tools are using the same Linux security primitives. There is really not any difference between them from a security perspective. Technically flatpak is based around bubblewrap for some of the low level bits, which is kind of like an even simpler version of firejail: https://github.com/containers/bubblewrap https://github.com/containers/bubblewrap
  - kaba0 5y ago
    I’ve read a security researcher’s option on firejail - that it is problematic as it is a suid executable. Making a potential bug into a root exploit. Could someone verify/disprove this? I would guess it drops privileges as soon as they are not needed but didn’t yet have the time to look at it and I have no sufficient knowledge to say whether privilege dropping is enough.
    - zxzax 5y ago
      It really depends on what you're trying to do. Doing some things on some distros is still not possible without having the setuid bit.
lokedhs 5y ago
I have, and while it's likely that I would be able to use it correctly, it's not something most regular users would be able to configure. And to be honest it seems that to configure firejail to be as secure as possible takes a lot more effort than using Qubes OS. Both solutions seem to be squarely in the domain of people who who understand security, which excludes the people who needs it the most.

zxzax 5y ago

Firejail can easily suffer from some of the same issues, if it's not configured properly. Some of the issues listed here are not specific to Flatpak, and need to be addressed with any sandboxing mechanism.

eikenberry 5y ago
Firejail is a tool, and a pretty nice one. But it isn't simple to use yet. But with support for using overlay filesystems for home or root, combined with cgroups isolation and it covers the issues that site brings up.
- zxzax 5y ago
  Flatpak handles all that too, all these tools are using the same Linux security primitives. There is really not any difference between them from a security perspective. Technically flatpak is based around bubblewrap for some of the low level bits, which is kind of like an even simpler version of firejail: https://github.com/containers/bubblewrap https://github.com/containers/bubblewrap
- kaba0 5y ago
  I’ve read a security researcher’s option on firejail - that it is problematic as it is a suid executable. Making a potential bug into a root exploit. Could someone verify/disprove this? I would guess it drops privileges as soon as they are not needed but didn’t yet have the time to look at it and I have no sufficient knowledge to say whether privilege dropping is enough.
  - zxzax 5y ago
    It really depends on what you're trying to do. Doing some things on some distros is still not possible without having the setuid bit.

lokedhs 5y ago

I have, and while it's likely that I would be able to use it correctly, it's not something most regular users would be able to configure. And to be honest it seems that to configure firejail to be as secure as possible takes a lot more effort than using Qubes OS. Both solutions seem to be squarely in the domain of people who who understand security, which excludes the people who needs it the most.