4 ms·

Firejail can easily suffer from some of the same issues, if it's not configured properly. Some of the issues listed here are not specific to Flatpak, and need t

• eikenberry 5y ago
  Firejail is a tool, and a pretty nice one. But it isn't simple to use yet. But with support for using overlay filesystems for home or root, combined with cgroups isolation and it covers the issues that site brings up.
  • zxzax 5y ago
    Flatpak handles all that too, all these tools are using the same Linux security primitives. There is really not any difference between them from a security perspective. Technically flatpak is based around bubblewrap for some of the low level bits, which is kind of like an even simpler version of firejail: https://github.com/containers/bubblewrap https://github.com/containers/bubblewrap
  • kaba0 5y ago
    I’ve read a security researcher’s option on firejail - that it is problematic as it is a suid executable. Making a potential bug into a root exploit. Could someone verify/disprove this? I would guess it drops privileges as soon as they are not needed but didn’t yet have the time to look at it and I have no sufficient knowledge to say whether privilege dropping is enough.
    • zxzax 5y ago
      It really depends on what you're trying to do. Doing some things on some distros is still not possible without having the setuid bit.