10 ms·
This is nice for example, just firejail --seccomp --private --profile your_profile bash and then run your more-secure rtorrent "session". If rtorrent is breache
by antocv 12y ago
This is nice for example, just firejail --seccomp --private --profile your_profile bash and then run your more-secure rtorrent "session". If rtorrent is breached, say buffer overflow/string format, the exploit would not have access to your ~. Let your rtorrent files be somewhere else than /home like /mnt/stuff.
- pwg 12y agoGranted, not identical from a security perspective, but you can achieve a lot of security separation for rtorrent by simply running rtorrent under a different user-id than the one you normally use (and restricting your homedir such that only your normal user-id is allowed to browse around within it).
- antocv 12y agoYes indeed. Firejail adds easy seccomp - right now only about 4-5 syscalls are blacklisted, but it would be gravy to specify a whitelist of syscalls and arguments on the command line to firejail. Other security improvments to do is to run with grsecurity, or just use alpine linux - it has all binaries compiled with stack-protection position independent code.