Bubblejail

From ArchWiki

Bubblejail is the Bubblewrap based sandboxing utility.

Bubblejail has a resource oriented permission model. For example, x11 is a resource that can be added to sandbox. This will give sandbox access to X11 display server.

Bubblejail also uses seccomp and D-Bus filtering to enhance security and permission model.

Bubblejail also has a graphical interface that allows creating and configuring sandboxes.

Installation

Install bubblejailAUR or bubblejail-gitAUR.

Usage

Bubblejail sandboxes are separated in to instances. Each instance is a separate home directory and a permissions configuration.

Each instance usually sandboxes one application.

Creating Instances

New instances are usually created from an available profiles. The profile is initial set of permissions and the desktop entry used. If a specific application is missing the profile a generic profile or empty profile can be used and tweaked after creation.

Note: The used profile only determines the initial set of permissions. Permissions can be freely modified after creation.

Using graphical interface

Run the Bubblejail Configuration application. On the first screen at the bottom there will be Create Instance button.

Using command line

For example, creating a Firefox instance:

$ bubblejail create --profile firefox instance_name

Running instance

Using desktop entry

When creating an instance a desktop entry will be generated unless --no-desktop-entry option was used.

Desktop entry would have the instance_name bubble name and can be launched from the desktop environment.

Using command line

Once created the instance can be run with run subcommand:

$ bubblejail run instance_name args

If no arguments are passed when the default arguments will be used based on the profile used.

If args are passed when those arguments will be executed inside the sandbox. First argument should be the binary name and following arguments will be passed to this binary.

Configuration

Once the instance has been created its permissions and resources can be modified. For modified permissions to take effect the sandbox needs to be restarted.

The profile used when creating sandbox only affect the initial set of permissions. However, removing certain permissions might prevent targeted application from working correctly.

Using graphical interface

Run the Bubblejail Configuration application. On the first screen click on the name of the sandbox you want to modify. This will bring up the list of all available permissions and a Save button.

Using command line

Bubblejail provides edit command that will open the configuration file in the editor defined EDITOR Environment variables.

$ bubblejail edit instance_name

Bubblejail uses TOML for its configuration. The defined dictionaries gives permission for a specific resource and key value pairs inside dictionaries will set a specific resource settings.

For example:

[x11]

[home_share]
home_paths = [ "Downloads",]

This config defines two resources available to sandbox: the x11 windowing system and shares the Downloads directory in the home folder.

The available services and options are documented in bubblejail.services man page.

Tips and tricks

Running terminal inside sandbox

Using run command a terminal can be launched inside already running sandbox. The terminal can be used to debug the sandbox.

It is recommended to use the terminal application that requires minimal amount of permissions such as Alacritty which only requires access to windowing system. (either x11 or wayland)

$ bubblejail run instance_name alacritty

Re-using profile for similar applications

If an application is missing a profile but there is a related software with existing profile that profile can be used.

For example, chromium profile can be used on any chromium derived browser such as qutebrowser.

First, generate the instance using chromium profile but disable the desktop entry creation.

$ bubblejail create --no-desktop-entry --profile chromium qutebrowser

Now a desktop entry can be created from the qutebrowser's desktop entry.

bubblejail generate-desktop-entry --desktop-entry /usr/share/applications/org.qutebrowser.qutebrowser.desktop qutebrowser

Now the sandboxed qutebrowser can be launched with qutebrowser bubble desktop entry.

See also