{"id":106390,"date":"2023-01-19T00:48:17","date_gmt":"2023-01-18T22:48:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-sistemy-izolyaczii-prilozhenij-firejail-0-9-72"},"modified":"2023-01-19T00:48:17","modified_gmt":"2023-01-18T22:48:17","slug":"vypusk-sistemy-izolyaczii-prilozhenij-firejail-0-9-72","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-sistemy-izolyaczii-prilozhenij-firejail-0-9-72","title":{"rendered":"Release of the application isolation system Firejail 0.9.72","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The release of Firejail 0.9.72 has been published, which develops a system for isolated execution of graphical, console, and server applications, minimizing the risk of compromising the main system when running untrusted or potentially vulnerable programs. The program is written in C, distributed under the GPLv2 license, and can operate on any Linux distribution with a kernel version older than 3.0. Pre-built packages for Firejail are available in deb (Debian, Ubuntu) and rpm (CentOS, Fedora) formats. <\/p>\n
Firejail uses namespaces, AppArmor, and syscall filtering (seccomp-bpf) in Linux for isolation. After launch, the program and all its child processes use separate views of kernel resources, such as the network stack, process table, and mount points. Interdependent applications can be combined into a single shared sandbox. If desired, Firejail can also be used to run Docker, LXC, and OpenVZ containers. <\/p>\n
Unlike container isolation tools, firejail is extremely simple to configure and does not require a prepared system image \u2014 the container is formed on-the-fly based on the contents of the current filesystem and is removed after the application completes. Flexible access control rules for the filesystem are provided, allowing you to specify which files and directories access is permitted or denied, connect temporary filesystems (tmpfs) for data, restrict access to files or directories to read-only, and combine directories via bind-mount and overlayfs. <\/p>\n
Pre-prepared isolation profiles for system calls are available for a large number of popular applications, including Firefox, Chromium, VLC, and Transmission. To obtain the necessary privileges for setting up an isolated environment, the firejail executable is installed with the SUID root flag (privileges are dropped after initialization). To run a program in isolation mode, simply specify the application's name as an argument to the firejail utility, for example, 'firejail firefox' or 'sudo firejail \/etc\/init.d\/nginx start'. <\/p>\n
In the new release: <\/p>\n
\n
A seccomp filter for system calls has been added, blocking the creation of namespace (the option \u201c--restrict-namespaces\u201d has been added for this). The system call tables and seccomp groups have been updated.\n
Improved the force-nonewprivs (NO_NEW_PRIVS) mode, which prevents obtaining additional privileges in new processes.\n
The ability to use custom AppArmor profiles has been added (the option \u201c--apparmor\u201d has been suggested for this).\n
In the nettrace network traffic monitoring system, which displays information about IP and traffic intensity from each address, support for ICMP has been implemented and the options \u201c--dnstrace\u201d, \u201c--icmptrace\u201d, and \u201c--snitrace\u201d have been proposed.\n
The commands --cgroup and --shell have been removed (by default, --shell=none is applied). By default, the building of firetunnel has been halted. chroot, private-lib, and tracelog settings in \/etc\/firejail\/firejail.config have been disabled. Support for grsecurity has been discontinued. <\/ul>\n