/tech/ - Technology★

I just use firejail

I just whistle the HTTP packages in my 33.6k modem.

>>980295

What does firejail in this case that's better?

Looking at https://firejail.wordpress.com/support/ doesn't show firejail to be as robust as the other solution.

Look like it's just a Linux only attempt at possibly bootlegging together real jails.

https://firejail.wordpress.com/support/

>Why on earth should I use Firejail?

>Actually, most of the time you don’t need to learn anything, just prefix your application with “firejail” and run it. This makes Firejail ideal for the regular, not-so-skilled home user.

>not-so-skilled home user.

Oh... ok then.

https://firejail.wordpress.com/

>Firejail is a SUID program

That's nice I guess. :/

>>980336

It enables seccomp, blacklists many unnecessary programs and libraries so they can't be executed by the program being firejailed, applies netfilters, blocks certain permissions, mounts temporary overlayFs directories on places like /tmp... it is a much more thorough solution than just sudo-ing a program, although the fact that it uses namespaces and apparently had a root privilege escalation vulnerability back in 2017 make it more of a sidegrade than a straight upgrade.

>>980342

So basically a convoluted Linux only solution in a SUID program that isn't any better than running under a less privileged user. So why aren't we just logging in under root and using firejail wrapped around everything we run?

>>980370

Running under a different user doesn't do seccomp, boy.