2

I know the fine tool firejail, which allows to sandbox programs, so they cannot access /home, /media and so on.

What it cannot do is to replace system data in the sandbox. This means when I sandbox a program, it can for example read /etc/passwd and see which user accounts are in there.

Is there a sandbox solution, which allows to hide this and e.g. replace /etc completely with a fake directory with default files from a fresh installation or similiar?

The best solution after firejail seems to be an LXC container. But this would mean installing one container per program with all the required libraries (which could be quite a lot especially for X11 programs) and accessing X11, audio, and some other things isn't that easy as well. Furthermore all containers need to have separate updates.

Another solution may be docker and forking one base VM several times, but this suffers from not having common updates as well.

Is there another software for easy lightweight jails, which can hide as much from the system as possible?

Improve this question
2
  • On the note of LXC and'or Docker, if you combine them with a system management tool like Ansible or Puppet, you can easily do coordinated updates. Combining all of that, in turn, with a storage platform that provides deduplication (such as BTRFS or ZFS), will mitigate a vast majority of the space wasted by having multiple copies of each library.
    – Austin Hemmelgarn
    Commented Jun 18, 2018 at 16:57
  • There are such solutions, but they are kind of overkill. When you look at firejail, it has almost zero overhead and just mounts tmpfs over the filesystem parts to hide and bind-mounts the parts which should be allowed and copies files to be replaced. The problem is that they cannot allow you to copy files to a temporary /etc as this would allow privilege escalation.
    – allo
    Commented Jun 19, 2018 at 9:10

1 Answer 1

Reset to default
1

firejail can be set to fake specific files:

COLUMNS=65 man firejail 2> /dev/null | grep -A 5 '\-\-bind=filename1,filename2'

Output:

       --bind=filename1,filename2
              Mount-bind filename1 on top  of  filename2.  This
              option is only available when running as root.

              Example:
              # firejail --bind=/config/etc/passwd,/etc/passwd

Notes:

  • I haven't tested to see if that works with directories.

  • firejail has a lot of options, as well as a complex config file, neither of which I've studied very thoroughly. Perhaps there's a better method than --bind.

Improve this answer
1
  • This is true, but I discussed the issue with the developer and the problem of firejail there seems to be, that a user which can replace the passwd (or shadow) file in a jail can get root permissions on the host system. So this is only feasible for jails running as root and no change is possible. That's why I am looking around if there is a similar solution without this problem. LXC App containers are a step in the right direction, but there seems to be no easy option to construct a jail hiding unwanted files like firejail does.
    – allo
    Commented Jun 22, 2018 at 7:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.