{"id":34673,"date":"2019-10-31T21:59:45","date_gmt":"2019-10-31T18:59:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-60\/"},"modified":"2019-10-31T21:59:45","modified_gmt":"2019-10-31T18:59:45","slug":"vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-60","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-60","title":{"rendered":"Release of the Firejail application isolation system 0.9.60","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Came to light<\/a><\/noindex> project release Firejail 0.9.60<\/a><\/noindex>, within which a system for the isolated execution of graphical, console, and server applications is developed. Using Firejail minimizes the risk of compromising the main system when running untrusted or potentially vulnerable programs. The program is written in C, is distributed<\/a><\/noindex> under the GPLv2 license and can operate on any Linux distribution with a kernel newer than 3.0. Ready-made packages for Firejail are prepared<\/a><\/noindex> are available in deb (Debian, Ubuntu) and rpm (CentOS, Fedora) formats.<\/p>\n

For isolation in Firejail it uses<\/a><\/noindex> namespaces, AppArmor, and syscall filtering (seccomp-bpf) in Linux. Once launched, the program and all its child processes use separate views of kernel resources, such as the network stack, process table, and mount points. Interdependent applications can be combined into a single common sandbox. If desired, Firejail can also be used for running Docker, LXC, and OpenVZ containers. <\/p>\n

Unlike container isolation tools, Firejail is extremely simple<\/a><\/noindex> In configuration, no system image preparation is required \u2014 the container's composition is created on the fly based on the current filesystem contents and deleted after the application finishes running. Flexible tools for setting access rules to the filesystem are provided, allowing you to specify which files and directories access is permitted or denied, connect temporary filesystems (tmpfs) for data, restrict access to files or directories to read-only, and combine directories via bind-mount and overlayfs.<\/p>\n

For many popular applications, including Firefox, Chromium, VLC, and Transmission, ready-made profiles<\/a><\/noindex> Isolation of system calls. To run a program in isolation mode, simply specify the application name as an argument to the firejail utility, for example, 'firejail firefox' or 'sudo firejail \/etc\/init.d\/nginx start'. <\/p>\n

In the new release:<\/p>\n