Firejail

From ArchWiki
Jump to: navigation, search

Firejail is an easy to use SUID sandbox program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces, seccomp-bpf and Linux capabilities.

Installation

Install either firejail, firejail-gitAUR or the firejail-apparmorAUR package which provide all of the requirements out of the box.

Note: The User-namespace (CONFIG_USER_NS=Y) is not set in the kernel configuration. Impact on Firejail users is deemed negligable. See FS#36969 for details why this namespace is disabled by default. User-namespaces are enabled by default in linux-hardened package.
Warning: While upstream is gradually adopting whitellists, (cf /etc/firejail/firefox.profile,) most of the supplied profiles still rely heavily on blacklists. This means that anything not explicitly forbidden by the profile will be accessible to the application. For example, if you have btrfs snapshots available in /mnt/btrfs, a jailed program may be forbidden from accessing $HOME/.ssh, but would still be able to access /mnt/btrfs/@some-snapshot/$HOME/.ssh. Make sure to audit your profiles, see #Testing profiles

Configuration

Most users will not require any custom configuration, and can proceed to the usage section, below.

Firejail uses profiles to set the security protections for each of the applications executed inside of it - you can find the default profiles in /etc/firejail/application.profile. Should you require custom profiles for applications not included, or wish to modify the defaults, you may place new rules or copies of the defaults in the ~/.config/firejail/ directory. You may have multiple custom profile files for a single application, and you may share the same profile file among several applications.

If firejail does not have a profile for a particular application, it uses its restrictive system-wide default profile. This can result in the application not functioning as desired, without first creating a custom, and less restrictive profile.

Refer to man(5) firejail-profile.

Usage

To execute an application using firejail's default protections for that application (the default profile), execute the following:

$ firejail <program name>

One-time additions to the default profile can be added as command line options (see the man page). For example, to execute okular with seccomp protection, execute the following:

$ firejail --seccomp okular

You may define multiple non-default profiles for a single program. Once you create your profile file, you can use it by executing:

$ firejail --profile=/absolute/path/to/profile <program name>

Using Firejail by default

To use Firejail by default for all applications for which it has profiles, run the firecfg tool as root.

# firecfg

This creates symbolic links in /usr/local/bin pointing to /usr/bin/firejail, for all programs for which firejail has default profiles. Once this is done, you only need to prefix a program with firejail if you want to run it with some custom security setting.

You can manually do this for individual applications by executing:

# ln -s /usr/bin/firejail /usr/local/bin/<program name>
Note: For a daemon, you will need to overwrite the systemd unit file for that daemon to call firejail, see systemd#Editing provided units.
Note: firecfg doesn't work with some cli shells such as: tar, curl, wget, git and ssh which need to be symlinked manually. One should also note that, while symlinking these shells does not affect official packages likepacman, doing so may break certain AUR packages. In particular, without weakening the /etc/firejail/curl.profile, symlinking curl will break YaourtAUR, but not, for example, CowerAUR.
Warning: Upstream provides profiles for gpg and gpg-agent. If gpg is symlinked with the supplied profile, pacman will be unable to update the archlinux-keyring.
Troubleshooting .desktop files

Some GUI application launchers (.desktop files) are coded using absolute paths to an executable, which circumvents firejail's symlink method of ensuring that it is being used. The firecfg tool includes an option to over-ride this on a per-user basis by copying the .desktop files from /usr/share/applications/*.desktop to ~/.local/share/applications/ and replacing the absolute paths with simple file names.

$ firecfg --fix

There may cases for which you need to manually modify the EXEC line of the .desktop file in ~/.local/share/applications/ to explicitly call Firejail. For example, to sandbox Thunar Bulk Rename, modify ~/.local/share/applications/Thunar-bulk-rename.desktop to read:

Exec=firejail --profile=/etc/firejail/thunar.profile /usr/lib/Thunar/ThunarBulkRename
Note: Depending on your setup, you might need to use 'Thunar.profile' rather than 'thunar.profile'

Verifying Firejail is being used

$ firejail --list

Creating custom profiles

Whitelists and Blacklists

Blacklists are permissive:

  • Permit everything not explicitly forbidden: blacklist <location/file>
  • Permit file or location in any blacklist that follows: noblacklist <location/file>

Whitelists are restrictive:

  • Forbid everything not explicitly permitted: whitelist <location/file>
  • Forbid file or location in any whitelist that follows: nowhitelist <location/file>

Profile writing

The basic process is:

  1. Copy the default profile,(which uses blacklists,) to your work folder and give it a unique name:
  2. Change the line include /etc/firejail/default.local to include /etc/firejail/ProfileName.local
  3. Gradually comment/uncomment the various options while checking at each stage that the application runs inside the new sandbox
  4. Desirable options not available in the copied default profile can be found by consulting the manual
  5. Build a whitelist of permitted locations. For portability, it may be advisable to place at least some of this list it in a .local file
  6. Test the profile for security holes, see #Testing profiles
  7. Once satisfied, copy your new profile to either /etc/firejail/ or ~/,config/firejail/

You may find the following to be useful:

  1. firejail --debug $OtherOptions $PathToProfile $Program > $PathToOutputFile Gives a detailed breakdown of the sandbox
  2. firejail --debug-caps gives a list of caps supported by the current Firejail software build. This is useful when building a caps whitelist.
  3. firejail --help for a full list of --debug options
  4. firemon PID monitors the running process. See firemon --help for details
  5. checksec may also be useful in testing which standard security features are being used
Note: The idea is to be as restrictive as possible, while still maintaining usability. This may involve sacrificing potentially dangerous functionality and a change in cavalier work habits.
Note: By default, seccomp filters work on a blacklist, (which can be found in the manual.) It is possible to use seccomp.keep to build a custom whitelist of filters for an application. See here.
Note: The list of possible options for a firejail profile is extensive, and users should consult man(5) firejail-profile.

Persistent local customisation

The standard profile layout now includes the capability to make persistent local customisations through the inclusion of .local files. Basically, each officially supported profile contains the lines include /etc/firejail/ProgramName.local and include /etc/firejail/globals.local. Since the order of precedence is determined by which is read first, this makes for a very powerful way of making local customisations. For example, with reference this firejail question, to globally enable Apparmor and disable Internet connectivity, one could simply create/edit /etc/firejail/globals.local to include the lines

# enable Apparmor and disable Internet globally
net none
apparmor

Then, to allow, for example, "curl" to connect to the internet, yet still maintain its apparmor confinement, one would create/edit /etc/firejail/curl.local to include the lines.

# enable internet for curl
ignore net

Since curl.local is read before globals.local, ignore net overrides net none, and, as a bonus, the above changes would be persistent across future updates.

Testing profiles

Firejail's built in audit feature allows the user to find gaps in a security profile by replacing the program to be sandboxed with a test program. By default, firejail uses the faudit program distributed with Firejail. (Note: A custom test program supplied by the user can also be used.) Examples:

  1. Run the default audit program: $ firejail --audit transmission-gtk
  2. Run a custom audit program: $ firejail --audit=~/sandbox-test transmission-gtk

In the examples above, the sandbox configures the transmission-gtk profile and starts the test program. The real program, transmission-gtk, will not be started.

Note: The audit feature is not implemented for --x11 commands.

Firetools

A GUI application for use with Firejail is also available, firetoolsAUR.

Firejail with Apparmor

Since 0.942, firejail-apparmorAUR, has supported more direct integration with Apparmor through a generic apparmor profile. During installation, the profile, firejail-default, is placed in /etc/apparmor.d directory, and needs to be loaded into the kernel by running the following command as root:

# aa-enforce firejail-default

To quote the manual:

The installed profile tries to replicate some advanced security features inspired by kernel-based Grsecurity:
- Prevent information leakage in /proc and /sys directories.The resulting filesystem is barely enough for running commands such as "top" and "ps aux".
- Allow running programs only from well-known system paths, such as /bin, /sbin, /usr/bin etc. Running programs and scripts from user home or other directories writable by the user is not allowed.
- Disable D-Bus. D-Bus has long been a huge security hole, and most programs don't use it anyway. You should have no problems running Chromium or Firefox.

With the release of 0.9.50, local customisations of the apparmor profile are supported by editing the file /etc/apparmor.d/local/firejail-local

Apparmor usage

There are a number of ways to enable Apparmor confinement on top of a Firejail security profile:

  • Pass the --apparmor flag to Firejail in the command line, eg firejail --apparmor firefox
  • Use a custom profile.
  • Enable Apparmor globally in /etc/firejail/globals.local and disable as needed through the use of ignore apparmor in /etc/firejail/<ProgramName>.local.

Troubleshooting

General

Some applications do not work properly with Firejail, and others simply require special configuration. In the instance any directories are disallowed or blacklisted for any given application, you may have to further edit the profile to enable nonstandard directories that said application needs to access. One example is wine; wine will not work with seccomp in most cases.

Other configurations exist; it is suggested you check out the man page for firejail to see them all, as firejail is in rapid development.

Symlinks

  1. If you are depending upon `firecfg` to have generated a symlink, ie. you followed the instructions for #Using Firejail by default, double-check that the symlink was actually created. You may need to create one manually.
  2. If the symlink exists, you may need to run `sudo updatedb` to update the location database.
  3. You may need to re-initialize the hash for the executable, ie. `hash -d <command_name>`.
  4. Some applications, notably 'Thunar', run with only one instance. This means that, after symlinking, you need to log out and back in again before the profile is loaded.

PulseAudio

If Firejail causes PulseAudio to misbehave, there is a known issue. A temporary workaround:

cp /etc/pulse/client.conf ~/.config/pulse/
echo "enable-shm = no" >> ~/.config/pulse/client.conf

Hidepid

if you have hidepid installed, Firemon can only be run as root. This, among other things, will cause problems with the Firetools GUI incorrectly reporting "Capabilities", "Protocols" and the status of "Seccomp". See this issue.

Makepkg

With respect to this Arch Forum post. During the final stages of a pkgbuild, (when compressing the package,) symlinks to gzip and xz interfere with makepkg’s ability to preload the libfakeroot.so The most elegant way of solving the problem is to temporarily exclude /usr/local/bin from the makepkg $PATH by appending the following to /etc/makepkg.conf

# Temporarily alter the makepkg PATH variable to exclude /usr/local/bin
PATH=":$PATH"
PATH="${PATH/:\/usr\/local\/bin:/:}"
PATH="${PATH/:\/usr\/local\/sbin:/:}"
export PATH="${PATH#:}"

The linked post offers a fully tested makepkg.profile and using the above solution, makepkg can itself be symlinked to use firejail by default.

Tips and tricks

Dealing with Paths containing spaces

If you need to reference, whitelist, or blacklist a directory within a custom profile, such as with palemoonAUR, you must do so using the absolute path, without encapsulation or escapes:

/home/user/.moonchild productions

Private mode

Firejail also includes a one time private mode, in which no mounts are made in the chroots to your home directory. In doing this, you can execute applications without performing any changes to disk. For example, to execute okular in private mode, do the following:

$ firejail --seccomp --private okular

See also