Can you explain how to sandbox process with systemd? about firejail-profiles HOT 4 CLOSED

So I think explaining how to sandbox just using systemd is out the scope of this repo. Long story short, you can use many directives like the ones in systemd.resource-control, systemd.service, and systemd.exec to restrict which directories the program can access, set up temporary filesystems over certain directories, restrict resource access, etc. The entire thing is pretty well-documented. I personally have used directives like ProtectSystem,ProtectHome,ProtectKernelTunables,ProtectKernelModules,ProtectControlGroups,MemoryDenyWriteExecute,LockPersonality,PrivateTmp,PrivateUsers,CapabilityBoundingSet,ReadWritePaths,WorkingDirectory, and so on.

One thing I will go into detail here, though, is how to join firejail with systemd. The way I usually do it is use systemd just for the process management aspect (so no sandboxing) and use firejail to actually sandbox the program. This setup works fairly well for programs spawned as my user (not root or a system user). For ease of use, I usually also create a script to run the program so that I can just edit the script and restart the unit rather than having to edit the unit file and do daemon-reload.

from firejail-profiles.

Ohh, i understand. I was talking about that because you say it in your README:

Just a note: I would highly recommend using systemd to sandbox system processes. I personally do not use firejail to sandbox system processes since I'm using systemd to start the process anyway (so it's easier to use the sandboxing capabilities of systemd itself).

But you have reason, you were talking about system processes, not applications (anyways consider that each application running is a process).

from firejail-profiles.

@Edu4rdSHL

Ohh, i understand. I was talking about that because you say it in your README:

Yeah, I figured it was outside the scope of this project to document it though 😜

But you have reason, you were talking about system processes, not applications (anyways consider that each application running is a process).

Yeah, it was more to explain why I wasn't writing profiles for system-wide daemons (which were sometimes requested).

from firejail-profiles.

I'm going to go ahead and close this for now. @Edu4rdSHL, please feel free to re-open if you have more questions.

from firejail-profiles.