3 ms·
Are they superior to firejail on linux? I kind of always figured they were similar level of "sandboxing" but I never had enough interest in BSD to dig in myself
by stjohnswarts 5y ago
Are they superior to firejail on linux? I kind of always figured they were similar level of "sandboxing" but I never had enough interest in BSD to dig in myself.
- trasz 5y agoThey are completely different mechanism for doing different kind of stuff. Firejail sounds like something closer to Capsicum, but without the security model.
- stjohnswarts 5y agoI was under the impression they were like jails, to sandbox a program and make it more siloed off and secure? Whatever the underlying mechanisms for obtaining that. I'll research some more I guess.
- tome 5y agoCould you elaborate on the differences? As far as I understood it firejail, or rather the Linux features that it depends upon, is far more powerful than FreeBSD jails.
- trasz 5y agoFrom what I understand, firejail is a "syscall filter". This moves it to the same category as capsicum (https://www.freebsd.org/cgi/man.cgi?capsicum https://www.freebsd.org/cgi/man.cgi?capsicum), but without Capsicum's security model, instead implementing something ad-hoc, probably by using Linux' seccmp. Jails, on the other hand, are not a sandboxing mechanism - they are system-level virtualization, like Linux namespaces, but with a simpler interface. You can use it for sandboxing, but it's not what the mechanism fundamentally is.
- heavyset_go 5y agoFirejail does more than just syscall filtering.
- trasz 5y agoPlease tell more.
- heavyset_go 5y agoCheck this out: https://firejail.wordpress.com/features-3/ https://firejail.wordpress.com/features-3/
- trasz 5y agoLooks like a GUI wrapper around jails, with some seccmp hacks to work around deficiencies in namespaces.