3 ms·
You can't spin up a veth network device without a suid executable. A better approach would be to have most of the sandboxing code run unprivileged and only call
by the8472 5y ago
You can't spin up a veth network device without a suid executable. A better approach would be to have most of the sandboxing code run unprivileged and only call a more specialized suid helper for the networking stuff.
> Though I would love to hear if anyone has any other use cases where firejail really shines compared to the other similar tools to manage namespaces and seccomp.
It also supports sandboxing X11 and dbus. So in that sense it's more like flatpak than docker.
- brobinson 5y ago>You can't spin up a veth network device without a suid executable. Doesn't this just require CAP_NET_ADMIN?
- the8472 5y agoYes, I should have said "without elevated privileges". That capability is still a pretty big hammer you want extracted into a helper that only does one thing.
- throwaway82652 5y agoI hope it's possible to relax that capability in the kernel somehow, that may be a next step for someone working on sandboxing.
- throwaway82652 5y agoI was under the impression the X11 and dbus sandboxing was done with Xpra and xdg-dbus-proxy, which are not part of firejail.
- the8472 5y agoYes, but firejail integrates them, docker does not.
- throwaway82652 5y agoGood point, that's very helpful to know.