3 ms·
I think this is just a comment on Firejail's implementation, as I think Firejail runs as root and thus must enforce its own permission checks. It seems like bu
by iancarroll 5y ago
I think this is just a comment on Firejail's implementation, as I think Firejail runs as root and thus must enforce its own permission checks.
It seems like bubblewrap uses a mount namespace created by the current user which would allow controlling access without any special checks.
- dj_gitmo 5y agoI'm running firejail now and It doesn't look like it runs as root.
- anderspitman 5y agoCorrect, it is an SUID executable[0], as is bubblewrap. [0]: https://en.m.wikipedia.org/wiki/Setuid https://en.m.wikipedia.org/wiki/Setuid
- jwilk 5y agoThis is poorly documented, but if the kernel supports unprivileged user namespaces, bubblewrap works without suid.
- anderspitman 5y agoGood to know, thanks.
- yjftsjthsd-h 5y agoDoes/can firejail, or is that a difference?
- WhyNotHugo 5y agobubblewrap is only setuid if user namespaces are unavailable.