netblue30/firejail
Firejail
Firejail is a Linux application sandbox and kernel security wrapper that isolates untrusted applications from the host system. It uses kernel namespaces and seccomp filters to restrict filesystem access, drop kernel capabilities, and limit the system attack surface.
The project is distinguished by its use of predefined security profiles to automatically apply filesystem restrictions and syscall limits based on the executable being launched. It provides specialized isolation for portable packages such as AppImages and implements X11 display isolation via proxy servers to prevent keyboard logging and unauthorized screenshots.
Capabilities cover kernel hardening through privilege escalation prevention and system call filtering, as well as comprehensive network security. This includes the use of dedicated TCP/IP stacks, network traffic filtering, and custom DNS configurations. The tool also supports home directory segregation and integrates with desktop environments to automatically launch applications within restricted environments.
Monitoring tools are included to audit sandbox configurations, verify isolation effectiveness, and track real-time resource consumption.
Features
- Security Profiles - Applies predefined security rules and filesystem restrictions based on configuration files mapped to executables.
- Linux Sandboxes - Provides a security tool that uses Linux kernel namespaces and seccomp filters to isolate untrusted applications.
- Application Sandboxing - Firejail creates restricted environments for running untrusted applications to protect the underlying system from compromise.
- Kernel Capability Dropping - Removes privileged kernel capabilities from processes to prevent unauthorized administrative actions.
- Mount-Namespace Virtualization - Creates restricted filesystem views by mounting directories as read-only or hiding sensitive paths.
- Network Namespace Virtualization - Initializes a separate TCP/IP stack with its own routing table and firewall for traffic isolation.
- Security Profiles - Uses predefined configuration files to automatically set up filesystem containers and security filters.
- Application Resource Virtualization - Creates a virtualized environment with a dedicated filesystem and network stack to separate an application from the host.
- Namespace-Based Isolation - Uses Linux kernel namespaces to partition the filesystem, network stack, and process tree.
- Filesystem Permissions - Restricts an application's view of the disk by hiding sensitive directories or mounting folders as read-only.
- Code Sandboxing Environments - Provides isolated environments for running potentially malicious or untrusted software to protect the host system.
- System Call Surface Minimizers - Reduces the kernel attack surface by restricting the available system call interface to a controlled set.
- Hardware and Resource Restrictions - Limits application access to specific hardware devices and directories to reduce the overall system attack surface.
- Home Directory Isolation - Provides segregation of the user home directory by mounting temporary or custom directories over the actual home folder.
- Network Isolation - Initializes a separate TCP/IP stack and implements a network firewall to isolate sandboxed process traffic.
- Userspace Network Stacks - Provides a dedicated TCP/IP stack with a unique IP and MAC address to hide the host identity.
- Privilege Escalation Prevention - Blocks unauthorized permission increases using kernel namespaces and security filters.
- Linux Capability Management - Manages specific kernel privileges and device access via whitelisting to prevent privilege escalation.
- Secure Execution Wrappers - Implements a security wrapper that restricts filesystem access and drops kernel capabilities based on predefined profiles.
- Linux Security Hardening - Reduces the system attack surface by filtering syscalls, dropping capabilities, and limiting privileged actions.
- Container Privilege Restrictions - Drops unnecessary kernel privileges from sandboxed processes to minimize the host attack surface.
- Read-Only Filesystem Enforcement - Enforces read-only filesystem access and restricts an application's view of the disk by hiding sensitive paths.
- Seccomp Profiles - Implements seccomp profiles to restrict available system calls and reduce the kernel attack surface.
- Background Service Isolation - Modifies service execution lines to force background applications to run within a restricted sandbox environment.
- Secure Background Service Isolation - Runs background server processes with dedicated network namespaces and restricted capabilities to isolate services.
- Sandbox IP Assignments - Configures specific IP addresses or ranges for sandboxes to isolate them from the host and other clients.
- Automatic Sandbox Launching - Integrates with desktop and file managers to automatically sandbox applications launched via icons or menus.
- Desktop Environment Configurations - Configures desktop environment launchers and menus to run supported applications in restricted environments.
- X11 Protocol Implementations - Implements X11 isolation by replacing the primary server with a separate instance to block host access.
- X11 Proxy Protection - Renders applications via proxy servers to prevent keyboard loggers and screenshot utilities from accessing the host X11 server.
- Sandbox Auditing - Scans running sandboxes for security vulnerabilities and configuration errors to ensure proper isolation.
- Isolated Execution Sandboxes - Provides secure, resource-constrained execution environments for portable formats like AppImages and Wine applications.
- Binary Execution Sandboxes - Provides restricted binary execution sandboxes to isolate portable AppImage binaries from host resources.
- DNS Security - Proxies DNS queries over HTTPS to protect privacy and prevent tampering via non-logging providers.
- Custom DNS Resolvers - Allows specifying external DNS servers for the sandbox to bypass insecure local router settings.
- Network Protocol Restrictions - Restricts applications to specific network protocols by filtering access at the kernel level.
- Network Traffic Filters - Applies customized firewall rules to the sandbox to restrict network traffic to specific destinations.
- AppImage Sandbox Management - Provides a restricted execution environment specifically designed to run AppImage packages with limited permissions.
- Sandbox Security Configurations - Supports overriding default security settings using local configuration files to adjust application permissions.
- X11 Display Isolation - Renders graphical applications through a separate server instance to prevent keyboard logging and screenshots.
- X11 Display Security - Isolates graphical applications via proxy servers to prevent keyboard logging and unauthorized screenshots.
- AppImage Sandboxing - Mounts and executes AppImage formatted software directly within a restricted sandbox environment.
- Sandboxing Tools - Security sandbox with built-in support for portable application formats.
- Sicherheit und Härtung - Sandbox program for restricting untrusted application environments.
- Virtualization and Isolation - SUID program for restricting application security risks.
