3 ms·

"... I even had a separate Firefox jail that was only allowed to get out via a Tor socks proxy to avoid leaks ..." I have looked into doing this many times and

by rsync 5y ago

"... I even had a separate Firefox jail that was only allowed to get out via a Tor socks proxy to avoid leaks ..." I have looked into doing this many times and it's neither simple nor straightforward. Specifically: jailing a GUI app that you can interact with on your desktop. I can't remember what the most promising recipe I saw for this was but it wasn't quite promising enough to compel me to built it up ... and this discussion is always (rightly) hijacked with "just use Qubes" ...

VTimofeenko 5y ago
Firejail with spawning nested Xorg works fine for me, including text-only copypaste between "host" and "guest" and automatic file synchronization through bind-like mounts. For some firejails I also use Linux network namespaces to control traffic going through taps. My introduction to this approach was the alternative Gentoo handbook by Sakaki[1], but the principles would apply on any distro. There's also a very interesting read on Qubes-like experience on NixOs with Wayland and XWayland[2,3]. [1]: https://wiki.gentoo.org/wiki/User:Sakaki/Sakaki%27s_EFI_Install_Guide/Sandboxing_the_Firefox_Browser_with_Firejail https://wiki.gentoo.org/wiki/User:Sakaki/Sakaki%27s_EFI_Inst... [2]: https://roscidus.com/blog/blog/2021/03/07/qubes-lite-with-kvm-and-wayland/ https://roscidus.com/blog/blog/2021/03/07/qubes-lite-with-kv... [3]: https://roscidus.com/blog/blog/2021/10/30/xwayland/ https://roscidus.com/blog/blog/2021/10/30/xwayland/
- tome 5y ago
  What's nested Xorg? Do you mean you run each app in a separate VNC or RDP server?
  - VTimofeenko 5y ago
    An example would be Xephyr[1]. Archwiki[2] has a decent summary. In my case, I have the standard xorg session started by my login manager. Then I start Xephyr with a separate DISPLAY, that shows up as just a window in the parent environment. It does look kinda like RDP or VNC. [1]: https://linux.die.net/man/1/xephyr https://linux.die.net/man/1/xephyr [2]: https://wiki.archlinux.org/title/Xephyr https://wiki.archlinux.org/title/Xephyr
    - tome 5y ago
      That's very cool, thanks!
haroldp 5y ago
Bastille template to bootstrap Firefox: https://github.com/ddowse/jailfox https://github.com/ddowse/jailfox

by rsync 5y ago

VTimofeenko 5y ago

Firejail with spawning nested Xorg works fine for me, including text-only copypaste between "host" and "guest" and automatic file synchronization through bind-like mounts. For some firejails I also use Linux network namespaces to control traffic going through taps. My introduction to this approach was the alternative Gentoo handbook by Sakaki[1], but the principles would apply on any distro. There's also a very interesting read on Qubes-like experience on NixOs with Wayland and XWayland[2,3]. [1]: https://wiki.gentoo.org/wiki/User:Sakaki/Sakaki%27s_EFI_Install_Guide/Sandboxing_the_Firefox_Browser_with_Firejail https://wiki.gentoo.org/wiki/User:Sakaki/Sakaki%27s_EFI_Inst... [2]: https://roscidus.com/blog/blog/2021/03/07/qubes-lite-with-kvm-and-wayland/ https://roscidus.com/blog/blog/2021/03/07/qubes-lite-with-kv... [3]: https://roscidus.com/blog/blog/2021/10/30/xwayland/ https://roscidus.com/blog/blog/2021/10/30/xwayland/

tome 5y ago
What's nested Xorg? Do you mean you run each app in a separate VNC or RDP server?
- VTimofeenko 5y ago
  An example would be Xephyr[1]. Archwiki[2] has a decent summary. In my case, I have the standard xorg session started by my login manager. Then I start Xephyr with a separate DISPLAY, that shows up as just a window in the parent environment. It does look kinda like RDP or VNC. [1]: https://linux.die.net/man/1/xephyr https://linux.die.net/man/1/xephyr [2]: https://wiki.archlinux.org/title/Xephyr https://wiki.archlinux.org/title/Xephyr
  - tome 5y ago
    That's very cool, thanks!

haroldp 5y ago

Bastille template to bootstrap Firefox: https://github.com/ddowse/jailfox https://github.com/ddowse/jailfox