Firejail is an easy to use SUID sandbox program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces, seccomp-bpf and Linux capabilities. Used alone or combined with Grsecurity or other kernel hardening systems can further increase the security provided. Firejail is ideal for use with browsers, desktop applications, and daemons/servers alike.
TheAUR and AUR packages provide all of the requirements out of the box.
Firejail uses profiles for the applications executed inside of it - you can find the default profiles in /etc/firejail/profiles. Should you require custom profiles for applications not included, or wish to modify the defaults, you may place new rules or copies of the defaults in ~/.config/firejail.
To execute an application using firejail with seccomp protection, such as firefox, execute the following:
$ firejail --seccomp firefox
Ideally, you will want to copy the launchers for applications you intend to execute using firejail from /usr/share/applications/*.dekstop to ~/.local/share/applications/ and then proceed to include firejail on the EXEC line. For applications you launch from the shell, you should consider aliasing them in your shell's RC file. Finally, for daemons, you will have to edit the initscripts individually.
Further, some applications do not work properly with Firejail, and others simply require special configuration. In the instance any directories are disallowed or blacklisted for any given application, you may have to further edit the profile to enable nonstandard directories that said application needs to access.
Other configurations exist; it is suggested you check out the man page for firejail to see them all, as firejail is in rapid development.
Firejail also includes a one time private mode, in which no mounts are made in the chroots to your home directory. In doing this, you can execute applications without performing any changes to disk. For example, to execute firefox in private mode, do the following:
$ firejail --seccomp --private firefox
A GUI application for use with Firejail is also available,AUR.