{"id":54610,"date":"2019-12-30T00:00:00","date_gmt":"2019-12-29T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-62"},"modified":"2020-02-18T14:02:39","modified_gmt":"2020-02-18T11:02:39","slug":"vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-62","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-sistemy-izolyatsii-prilozhenij-firejail-0-9-62","title":{"rendered":"Release of the Firejail 0.9.62 application isolation system","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

After six months of development is available<\/a><\/noindex> project release Firejail 0.9.62<\/a><\/noindex>, within which a system for the isolated execution of graphical, console, and server applications is developed. Using Firejail minimizes the risk of compromising the main system when running untrusted or potentially vulnerable programs. The program is written in C, is distributed<\/a><\/noindex> under the GPLv2 license and can operate on any Linux distribution with a kernel newer than 3.0. Ready-made packages for Firejail are prepared<\/a><\/noindex> are available in deb (Debian, Ubuntu) and rpm (CentOS, Fedora) formats.<\/p>\n

For isolation in Firejail it uses<\/a><\/noindex> namespaces, AppArmor, and system call filtering (seccomp-bpf) in Linux. Once launched, the program and all its child processes use separate views of kernel resources, such as the network stack, process table, and mount points. Related applications can be grouped into a single shared sandbox. Firejail can also be used to run Docker, LXC, and OpenVZ containers if desired. <\/p>\n

Unlike container isolation tools, Firejail is extremely simple<\/a><\/noindex> in configuration and does not require a system image preparation \u2014 the container's contents are formed on-the-fly based on the current filesystem and deleted after the application finishes. Flexible access rule configuration tools are provided for the filesystem, allowing you to specify which files and directories are allowed or denied access, connect temporary filesystems (tmpfs) for data, restrict file or directory access to read-only, and combine directories through bind-mount and overlayfs.<\/p>\n

For many popular applications, including Firefox, Chromium, VLC, and Transmission, ready-made profiles<\/a><\/noindex> isolation of system calls. To gain the privileges necessary to configure the isolated environment, the firejail executable is installed with the SUID root flag (privileges are dropped after initialization). To run a program in isolation, simply specify the application name as an argument to the firejail utility, for example, \"firejail firefox\" or \"sudo firejail \/etc\/init.d\/nginx start.\" <\/p>\n

In the new release:<\/p>\n