Firejail 0.9.38 Release Announcement

We are happy to announce the release of Firejail version 0.9.38 (download). Firejail is a generic Linux namespaces security sandbox, capable of running graphic interface programs as well as server programs. The project went through an external security audit, and several SUID-releated problems have been found. Please update your software. The release brings in a number of new features, program interface changes, new application profiles and bugfixes:

Program interface changes

• –private-home feature was deprecated. If you were using it, please consider switching to –private=directory or –whitelist.
• –chroot running as user will fail if seccomp is not available in the current Linux kernel. Seccomp-bpf was introduced in version 3.5 of Linux kernel.
• –tmpfs option is allowed only if running as root. A new feature, –private-tmp was introduced for regular users. The feature mounts an empty tmpfs filesystem on top of /tmp directory.
• When more then one –protocol commands are present, the first one takes precedence.

Symlink invocation

This is a small thing, but very convenient. Make a symbolic link (ln -s) to /usr/bin/firejail under the name of the program you want to run, and put the link in the first $PATH position (for
example in /usr/local/bin). Example:

$ which -a transmission-gtk 
/usr/bin/transmission-gtk

$ sudo ln -s /usr/bin/firejail /usr/local/bin/transmission-gtk

$ which -a transmission-gtk 
/usr/local/bin/transmission-gtk
/usr/bin/transmission-gtk

We have in this moment two entries in $PATH for transmission. The first one is a symlink to firejail. The second one is the real program. Starting transmission in this moment, invokes “firejail transmission-gtk”

$ transmission-gtk
Redirecting symlink to /usr/bin/transmission-gtk
Reading profile /etc/firejail/transmission-gtk.profile
Reading profile /etc/firejail/disable-mgmt.inc
Reading profile /etc/firejail/disable-secret.inc
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Parent pid 19343, child pid 19344
Blacklist violations are logged to syslog
Child process initialized

This seems to be the easiest way to integrate Firejail in a desktop environment. In most cases clicking on a menu entry or an icon will sandbox the program. Use “firejail –tree” to check the program was sandboxed:

$ firejail --tree
5781:netblue:/usr/bin/firejail /usr/bin/transmission-gtk 
  5782:netblue:/usr/bin/firejail /usr/bin/transmission-gtk 
    5783:netblue:/usr/bin/transmission-gtk 

IPv6 support

      --ip6=address
              Assign IPv6 addresses to the last network interface defined by a
              --net option.

              Example:
              $ firejail --net=eth0 --ip6=2001:0db8:0:f101::1/64 firefox

       --netfilter6=filename
              Enable the IPv6 network filter specified by filename in the  new
              network  namespace.  The  filter  file  format  is the format of
              ip6tables-save  and  ip6table-restore  commands.   New   network
              namespaces  are  created  using  --net  option. If a new network
              namespaces is not created, --netfilter6 option does nothing.

Join command enhancements

       --join-filesystem
              Join the mount namespace of the sandbox. By
              default  a /bin/bash shell is started after joining the sandbox.
              If a program is specified, the program is run  in  the  sandbox.
              This  command is available only to root user.  Security filters,
              cgroups and cpus configurations are not applied to  the  process
              joining the sandbox.

      --join-network
              Join the network namespace of the sandbox. By
              default  a /bin/bash shell is started after joining the sandbox.
              If a program is specified, the program is run  in  the  sandbox.
              This  command is available only to root user.  Security filters,
              cgroups and cpus configurations are not applied to  the  process
              joining the sandbox.

–private-tmp

       --private-tmp
              Mount an empty temporary filesystem on top of /tmp directory.

              Example:
              $ firejail --private-tmp

–user

      --user=new-user
              Switch the user before starting the sandbox. This command should
              be run as root.

              Example:
              # firejail --user=www-data

CentOS 6.x support

CentOS 6 support was included in this release. You would need a Linux kernel version 3.2 or newer installed on the system.

Compile time options

Most Linux kernel security features require root privileges during configuration. The same is true for kernel networking features. Firejail (SUID binary) opens the access to these features to regular users. The privilege escalation is restricted to the sandbox being configured, and is not extended to the rest of the system. This arrangement works fine for user desktops or servers where the access is already limited.

If you not happy with a particular kernel feature, all the support can be eliminated from SUID binary at compile time. The following compile time options are implemented:

$ ./configure --help
[...]
  --disable-seccomp       disable seccomp
  --disable-chroot        disable chroot
  --disable-bind          disable bind
  --disable-network       disable network
  --disable-userns        disable user namespace
[...]

New security profiles

KMail, Seamonkey, Telegram, Mathematica, uGet, and mupen64plus.

About

For more information please visit the project page.