netblue30/firejail

Features

• Security Profiles - Applies predefined security rules and filesystem restrictions based on configuration files mapped to executables.
• Linux Sandboxes - Provides a security tool that uses Linux kernel namespaces and seccomp filters to isolate untrusted applications.
• Application Sandboxing - Firejail creates restricted environments for running untrusted applications to protect the underlying system from compromise.
• Kernel Capability Dropping - Removes privileged kernel capabilities from processes to prevent unauthorized administrative actions.
• Mount-Namespace Virtualization - Creates restricted filesystem views by mounting directories as read-only or hiding sensitive paths.
• Network Namespace Virtualization - Initializes a separate TCP/IP stack with its own routing table and firewall for traffic isolation.
• Security Profiles - Uses predefined configuration files to automatically set up filesystem containers and security filters.
• Application Resource Virtualization - Creates a virtualized environment with a dedicated filesystem and network stack to separate an application from the host.
• Namespace-Based Isolation - Uses Linux kernel namespaces to partition the filesystem, network stack, and process tree.
• Filesystem Permissions - Restricts an application's view of the disk by hiding sensitive directories or mounting folders as read-only.
• Code Sandboxing Environments - Provides isolated environments for running potentially malicious or untrusted software to protect the host system.
• System Call Surface Minimizers - Reduces the kernel attack surface by restricting the available system call interface to a controlled set.
• Hardware and Resource Restrictions - Limits application access to specific hardware devices and directories to reduce the overall system attack surface.
• Home Directory Isolation - Provides segregation of the user home directory by mounting temporary or custom directories over the actual home folder.
• Network Isolation - Initializes a separate TCP/IP stack and implements a network firewall to isolate sandboxed process traffic.
• Userspace Network Stacks - Provides a dedicated TCP/IP stack with a unique IP and MAC address to hide the host identity.
• Privilege Escalation Prevention - Blocks unauthorized permission increases using kernel namespaces and security filters.
• Linux Capability Management - Manages specific kernel privileges and device access via whitelisting to prevent privilege escalation.
• Secure Execution Wrappers - Implements a security wrapper that restricts filesystem access and drops kernel capabilities based on predefined profiles.
• Linux Security Hardening - Reduces the system attack surface by filtering syscalls, dropping capabilities, and limiting privileged actions.
• Container Privilege Restrictions - Drops unnecessary kernel privileges from sandboxed processes to minimize the host attack surface.
• Read-Only Filesystem Enforcement - Enforces read-only filesystem access and restricts an application's view of the disk by hiding sensitive paths.
• Seccomp Profiles - Implements seccomp profiles to restrict available system calls and reduce the kernel attack surface.
• Background Service Isolation - Modifies service execution lines to force background applications to run within a restricted sandbox environment.
• Secure Background Service Isolation - Runs background server processes with dedicated network namespaces and restricted capabilities to isolate services.
• Sandbox IP Assignments - Configures specific IP addresses or ranges for sandboxes to isolate them from the host and other clients.
• Automatic Sandbox Launching - Integrates with desktop and file managers to automatically sandbox applications launched via icons or menus.
• Desktop Environment Configurations - Configures desktop environment launchers and menus to run supported applications in restricted environments.
• X11 Protocol Implementations - Implements X11 isolation by replacing the primary server with a separate instance to block host access.
• X11 Proxy Protection - Renders applications via proxy servers to prevent keyboard loggers and screenshot utilities from accessing the host X11 server.
• Sandbox Auditing - Scans running sandboxes for security vulnerabilities and configuration errors to ensure proper isolation.
• Isolated Execution Sandboxes - Provides secure, resource-constrained execution environments for portable formats like AppImages and Wine applications.
• Binary Execution Sandboxes - Provides restricted binary execution sandboxes to isolate portable AppImage binaries from host resources.
• DNS Security - Proxies DNS queries over HTTPS to protect privacy and prevent tampering via non-logging providers.
• Custom DNS Resolvers - Allows specifying external DNS servers for the sandbox to bypass insecure local router settings.
• Network Protocol Restrictions - Restricts applications to specific network protocols by filtering access at the kernel level.
• Network Traffic Filters - Applies customized firewall rules to the sandbox to restrict network traffic to specific destinations.
• AppImage Sandbox Management - Provides a restricted execution environment specifically designed to run AppImage packages with limited permissions.
• Sandbox Security Configurations - Supports overriding default security settings using local configuration files to adjust application permissions.
• X11 Display Isolation - Renders graphical applications through a separate server instance to prevent keyboard logging and screenshots.
• X11 Display Security - Isolates graphical applications via proxy servers to prevent keyboard logging and unauthorized screenshots.
• AppImage Sandboxing - Mounts and executes AppImage formatted software directly within a restricted sandbox environment.
• Sandboxing Tools - Security sandbox with built-in support for portable application formats.
• Security And Hardening - Sandbox program for restricting untrusted application environments.
• Virtualization and Isolation - SUID program for restricting application security risks.

Star history