The release of Firejail 0.9.72 has been published, which develops a system for isolated execution of graphical, console, and server applications, minimizing the risk of compromising the main system when running untrusted or potentially vulnerable programs. The program is written in C, distributed under the GPLv2 license, and can operate on any Linux distribution with a kernel version older than 3.0. Pre-built packages for Firejail are available in deb (Debian, Ubuntu) and rpm (CentOS, Fedora) formats.
Firejail uses namespaces, AppArmor, and syscall filtering (seccomp-bpf) in Linux for isolation. After launch, the program and all its child processes use separate views of kernel resources, such as the network stack, process table, and mount points. Interdependent applications can be combined into a single shared sandbox. If desired, Firejail can also be used to run Docker, LXC, and OpenVZ containers.
Unlike container isolation tools, Firejail is extremely simple to configure and does not require a system image to be prepared— the container is formed on-the-fly based on the current filesystem content and is removed after the application has finished running. Flexible tools are provided for setting file system access rules, allowing you to define which files and directories access is permitted or denied, connect temporary file systems (tmpfs) for data, restrict file or directory access to read-only, and bind-mount and overlayfs directories.
Prepared isolation profiles for syscall filtering are available for a large number of popular applications, including Firefox, Chromium, VLC, and Transmission. To obtain the privileges necessary to set up an isolated environment, the firejail executable is installed with the SUID root flag (privileges are dropped after initialization). To run a program in isolation mode, you simply need to specify the application name as an argument to the firejail utility, for example, 'firejail firefox' or 'sudo firejail /etc/init.d/nginx start.'
In the new release:
- A seccomp syscall filter has been added to block namespace creation (the option '--restrict-namespaces' has been added to enable it). The syscall tables and seccomp groups have been updated.
- Improved the force-nonewprivs (NO_NEW_PRIVS) mode, which prevents obtaining additional privileges in new processes.
- Added the option to use custom AppArmor profiles (the option "--apparmor" is suggested for connection).
- In the nettrace network traffic monitoring system, which displays information about the IP and traffic intensity from each address, support for ICMP has been implemented, and the options "--dnstrace", "--icmptrace", and "--snitrace" have been provided.
- The commands --cgroup and --shell have been removed (by default, --shell=none is applied). The building of firetunnel has been halted by default. The chroot, private-lib, and tracelog settings in /etc/firejail/firejail.config have been disabled. Support for grsecurity has been discontinued.
Source: opennet.ru
