3 ms·
They are completely different mechanism for doing different kind of stuff. Firejail sounds like something closer to Capsicum, but without the security model.
by trasz 5y ago
They are completely different mechanism for doing different kind of stuff. Firejail sounds like something closer to Capsicum, but without the security model.
- stjohnswarts 5y agoI was under the impression they were like jails, to sandbox a program and make it more siloed off and secure? Whatever the underlying mechanisms for obtaining that. I'll research some more I guess.
- tome 5y agoCould you elaborate on the differences? As far as I understood it firejail, or rather the Linux features that it depends upon, is far more powerful than FreeBSD jails.
- trasz 5y agoFrom what I understand, firejail is a "syscall filter". This moves it to the same category as capsicum (https://www.freebsd.org/cgi/man.cgi?capsicum https://www.freebsd.org/cgi/man.cgi?capsicum), but without Capsicum's security model, instead implementing something ad-hoc, probably by using Linux' seccmp. Jails, on the other hand, are not a sandboxing mechanism - they are system-level virtualization, like Linux namespaces, but with a simpler interface. You can use it for sandboxing, but it's not what the mechanism fundamentally is.
- heavyset_go 5y agoFirejail does more than just syscall filtering.
- trasz 5y agoPlease tell more.
- heavyset_go 5y agoCheck this out: https://firejail.wordpress.com/features-3/ https://firejail.wordpress.com/features-3/
- trasz 5y agoLooks like a GUI wrapper around jails, with some seccmp hacks to work around deficiencies in namespaces.