project release , within which a system for the isolated execution of graphical, console, and server applications is developed. Using Firejail minimizes the risk of compromising the main system when running untrusted or potentially vulnerable programs. The program is written in C, under the GPLv2 license and can operate on any Linux distribution with a kernel newer than 3.0. Ready-made packages for Firejail are available in deb (Debian, Ubuntu) and rpm (CentOS, Fedora) formats.
For isolation in Firejail namespaces, AppArmor, and syscall filtering (seccomp-bpf) in Linux. Once launched, the program and all its child processes use separate views of kernel resources, such as the network stack, process table, and mount points. Interdependent applications can be combined into a single common sandbox. If desired, Firejail can also be used for running Docker, LXC, and OpenVZ containers.
Unlike container isolation tools, Firejail is extremely in configuration and does not require preparing a system image—the container composition is formed on the fly based on the contents of the current filesystem and is removed after the application has finished running. Flexible means for setting file system access rules are provided, allowing you to define which files and directories access is allowed or denied for, mount temporary filesystems (tmpfs) for data, restrict access to files or directories to read-only, and merge directories via bind-mount and overlayfs.
For many popular applications, including Firefox, Chromium, VLC, and Transmission, ready-made for syscall isolation are available. To run a program in isolation mode, it is sufficient to specify the application's name as an argument to the firejail utility, for example, "firejail firefox" or "sudo firejail /etc/init.d/nginx start."
In the new release:
- A vulnerability has been resolved that allowed a malicious process to bypass the syscall restriction mechanism. The essence of the vulnerability is that the Seccomp filters are copied to the /run/firejail/mnt directory, which is writable within the isolated environment. Processes launched in isolation mode can modify these files, leading to new processes started in the same environment being executed without applying the syscall filters;
- The memory-deny-write-execute filter has been implemented to block the 'memfd_create' call;
- A new 'private-cwd' option has been added to change the working directory for the jail;
- The '--nodbus' option has been added to block D-Bus sockets;
- Support for CentOS 6 has been restored;
- support for packages in formats and .
, that for these packages their own tools should be used; - New profiles have been added to isolate 87 additional programs, including mypaint, nano, xfce4-mixer, gnome-keyring, redshift, font-manager, gconf-editor, gsettings, freeciv, lincity-ng, openttd, torcs, tremulous, warsow, freemind, kid3, freecol, opencity, utox, freeoffice-planmaker, freeoffice-presentations, freeoffice-textmaker, inkview, meteo-qt, ktouch, yelp, and cantata.
Source: opennet.ru
