Comments (4)
So I think explaining how to sandbox just using systemd is out the scope of this repo. Long story short, you can use many directives like the ones in systemd.resource-control, systemd.service, and systemd.exec to restrict which directories the program can access, set up temporary filesystems over certain directories, restrict resource access, etc. The entire thing is pretty well-documented. I personally have used directives like ProtectSystem
,ProtectHome
,ProtectKernelTunables
,ProtectKernelModules
,ProtectControlGroups
,MemoryDenyWriteExecute
,LockPersonality
,PrivateTmp
,PrivateUsers
,CapabilityBoundingSet
,ReadWritePaths
,WorkingDirectory
, and so on.
One thing I will go into detail here, though, is how to join firejail
with systemd
. The way I usually do it is use systemd
just for the process management aspect (so no sandboxing) and use firejail
to actually sandbox the program. This setup works fairly well for programs spawned as my user (not root or a system user). For ease of use, I usually also create a script to run the program so that I can just edit the script and restart the unit rather than having to edit the unit file and do daemon-reload
.
from firejail-profiles.
Ohh, i understand. I was talking about that because you say it in your README:
Just a note: I would highly recommend using systemd to sandbox system processes. I personally do not use firejail to sandbox system processes since I'm using systemd to start the process anyway (so it's easier to use the sandboxing capabilities of systemd itself).
But you have reason, you were talking about system processes, not applications (anyways consider that each application running is a process).
from firejail-profiles.
Ohh, i understand. I was talking about that because you say it in your README:
Yeah, I figured it was outside the scope of this project to document it though 😜
But you have reason, you were talking about system processes, not applications (anyways consider that each application running is a process).
Yeah, it was more to explain why I wasn't writing profiles for system-wide daemons (which were sometimes requested).
from firejail-profiles.
I'm going to go ahead and close this for now. @Edu4rdSHL, please feel free to re-open if you have more questions.
from firejail-profiles.
Related Issues (20)
- request: profile for youtube-dl HOT 2
- More profiles HOT 8
- cool profiles HOT 7
- torbrowser-launcher used in conjunction with firejail and apparmor
- TeamViewer profile HOT 2
- signal does not start HOT 2
- Steam does not show HOT 1
- Libreoffice can not open documents on removable media HOT 2
- [Request] Profile for gradio HOT 2
- Keepassxc does not start in firejail mode
- Adapting firefox.common to other programs HOT 3
- [discussion] discord.profile: Doesn't need access to the entirety of /tmp HOT 4
- Breakage introduced by modifications to common.inc
- Tvheadend profile
- biscuit profile HOT 2
- tmate
- Better Documentation
- add Asbru Connection Manager profile
- New Profile for LyX
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from firejail-profiles.