3 ms·
What's the problem with firejail? Start with an empty profile, blacklist everything, and whitelist only the stuff you need. It works just fine for server applic
by 5e92cb50239222b 5y ago
What's the problem with firejail? Start with an empty profile, blacklist everything, and whitelist only the stuff you need. It works just fine for server applications, and unlike systemd isolation flags you can setup a proper separate firewall with the `netfilter` option.
- the8472 5y ago> blacklist everything, That isn't a whitelist approach.
- Someone 5y ago> blacklist everything, and whitelist only the stuff you need That _is_ a whitelist approach.
- the8472 5y agoNot really. For example if you have a construct like "blacklist *" and that wildcard is evaluated at construction time on some overlay filesystem then additional entries may sneak in later from the lower over the overlay because the wildcard expansion doesn't get updated. On the other hand if you start with a blank slate filesystem root and only bind exactly the whitelisted paths then there is nothing to leak through. There are other ways in which blacklist-all can fail to be equivalent to whitelisting.
- goodpoint 5y agoThat is exactly an allowlist approach.
- Seirdy 5y agoFirejail has had multiple sandbox escape vulns in the past. Firejail is an SUID executable in which sandbox escapes can lead to privilege escalation. In contrast, Systemd allows you to run services as unprivileged users, and even create users on demand. Systemd also supports firewalling: it supports IP address allow/deny policies, ports, etc. For more advanced firewall policies you're probably better off using an actual firewall daemon like firewalld or ufw.