The release of Firejail 0.9.78 has been published, which develops a system for the isolated execution of graphical, console, and server applications, allowing for the minimization of the risk of compromising the main system when running untrusted or potentially vulnerable programs. The program is written in C, distributed under the GPLv2 license, and can run on any Linux distribution with a kernel version above 3.0. Ready-made Firejail packages are available in deb (Debian, Ubuntu) and rpm (CentOS, Fedora) formats.
Firejail uses namespaces, AppArmor, and syscall filtering (seccomp-bpf) in Linux for isolation. After launch, the program and all its child processes use separate views of kernel resources, such as the network stack, process table, and mount points. Interdependent applications can be combined into a single shared sandbox. If desired, Firejail can also be used to run Docker, LXC, and OpenVZ containers.
Unlike container isolation tools, Firejail is extremely easy to configure and does not require a system image preparation — the container's composition is formed on the fly based on the contents of the current filesystem and is removed once the application has completed its task. Flexible access rules to the filesystem allow defining which files and directories are allowed or denied access, temporary filesystems (tmpfs) can be mounted for data, read-only access to certain files or directories can be restricted, and directories can be combined using bind-mount and overlayfs.
Prepared isolation profiles for syscall filtering are available for a large number of popular applications, including Firefox, Chromium, VLC, and Transmission. To obtain the privileges necessary to set up an isolated environment, the firejail executable is installed with the SUID root flag (privileges are dropped after initialization). To run a program in isolation mode, you simply need to specify the application name as an argument to the firejail utility, for example, 'firejail firefox' or 'sudo firejail /etc/init.d/nginx start.'
In the new release:
- The configuration file firejail.config has been updated with options arg-max-count, arg-max-len, env-max-count, and env-max-len to change the limits on the number and size of command line options and environment variables. By default, the number of arguments is limited to 128, the number of environment variables is 256, and each argument's size is limited to PATH_MAX from limits.h (which in Linux is 40196) + 32.
- An option "--xephyr-extra-params" has been added to specify additional options for Xephyr (used to create X11 sandbox environments with its own X server running in a window) in the command line without altering firejail.config.
- The utility bwrap (bubblewrap) installed in the sandbox environment has been replaced with a layer fbwrap that runs programs without isolation to resolve issues with running Firefox, Thunderbird, GIMP due to calls to glycin 2.0.0 from gdk-pixbuf2 using bwrap. An option "--allow-bwrap" has been added to bypass the use of bwrap instead of the layer.
- The syscall tables for seccomp have been updated. New system calls, such as epoll_pwait2 and futex_wait, have been added.
- The build option "--disable-globalcfg" has been removed, support for overlayfs ("--overlay") and IDS mode (Intrusion Detection System, "--ids") has been discontinued.
- Isolation profiles have been added for the text editor ne, the Trivalent browser, and the game engines OpenRA, quakespasm, gzdoom, lzdoom, uzdoom.
- Profiles have been updated for Thunderbird, Wine, Qutebrowser, Firefox, Godot, Wusc, Mullvad-browser, Blink, Steam, SSH, Brave, and Hashcat.
Source: opennet.ru
