ports
firejail
ports | firejail | |
---|---|---|
14 | 139 | |
475 | 5,449 | |
1.7% | - | |
10.0 | 9.7 | |
4 days ago | 5 days ago | |
Makefile | C | |
- | GNU General Public License v3.0 only |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
ports
- Wayland on OpenBSD
-
Firejail: Light, featureful and zero-dependency security sandbox for Linux
I think OpenBSD comes the closest to what you want with its two easy to use syscalls that provide syscall filtering and restricting access to paths:
https://man.openbsd.org/pledge.2
https://man.openbsd.org/unveil.2
A few random examples:
https://github.com/tmux/tmux/blob/c8494dff7b6b9a996866edaf8c...
https://github.com/openbsd/ports/blob/master/www/mozilla-fir...
https://github.com/openbsd/ports/blob/master/www/mozilla-fir...
To get the best isolation you need to patch the source — the application needs to go through initial setup and then drop privileges to the absolute possible minimum. But it's easy to make custom wrappers for third-party applications — the above profiles taken from the OpenBSD ports tree are the proof.
-
Understanding rc.d/
Have you checked the no-ip port: https://github.com/openbsd/ports/blob/master/net/no-ip/pkg/noip2.rc
-
OpenBSD: Shutdown/reboot now require membership of group _shutdown
> https://github.com/openbsd/ports/commit/bf33ea5f3ff390d8cde3...
Now, this is surprising. I randomly clicked on that link and I immediately see that the code and the patch has a bug. It only checks the first 8 characters:
- if (gr != NULL && strncmp(gr->gr_name, "operator", 8) == 0)
-
Does OpenBSD have temperature monitoring and CPU usage issues?
Some people are working around this by using obsdfreqd, some by patching sys/kern/sched_bsd.c (change if (hw_power) to if (0 && hw_power)), some by simply setting to a lower speed (sysctl hw.perfpolicy=manual and hw.setperf=99 might be enough as this disables turbo mode found on some CPUs).
-
How to compile something that requires OpenSSL?
You could also look into a port that has a hard dependency on openssl like: https://github.com/openbsd/ports/tree/master/security/sslscan
-
How I would sell OpenBSD as a salesperson
For me it's the ease of management and good documentation.
For example, during 6.8 to 6.9 upgrade, there was a major postgresql upgrade.
It is mentioned in the doc https://www.openbsd.org/faq/upgrade69.html (see Special packages at the bottom).
You're redirected to the package README with special instructions on how to setup and upgrade: https://github.com/openbsd/ports/blob/master/databases/postg...
Et voilà, everything is explained.
On debian, if I am not careful, I'll do an upgrade and risk breaking something during a db migration (I'm looking at you MySQL upgrades...).
- So I installed OpenBSD 7.0 on my iMac G3 and well no desktop environment will fully install because of missing packages… even compiling CDE was a no go because KSH93 is broken on macppc. At least it’s a step in the right direction as far as getting anything graphical working.
-
OpenBSD Gaming Updates Q2 2022
Godot engine gamecontroller support. This is limited and incomplete, but it's a start. A huge number of indie games made with Godot are released every week; most of which work at least partially with an XBox {360,One} controller. You can follow This Week in Godot if you're interested.
-
Handling argc==0 in the Linux kernel
> OpenBSD has handled this case for some years. I do not know if there was any breakage or fallout from this.
The other thing about OpenBSD is that when they make a change to their OS, they also go through to make sure all the (third-party) ports/packages:
* https://cvsweb.openbsd.org/ports/
* https://github.com/openbsd/ports
do not break. So they're create patches for the software and and submit them upstream.
firejail
-
Sandboxing All the Things with Flatpak and BubbleBox
bubblewrap is designed as a low-level too. There is nothing quick and dirty about it. It disallows everything by default and you have to be explicit about what you want to share with the host. If your application needs complex permissions/resources, then you will need to have a complex bubblewrap command line.
Once you have figured out which permissions/resources you need for a given program, you can wrap the command line invocation in a shell script.
If you want other people to do the work of defining permissions/resources, then have a look at firejail: https://github.com/netblue30/firejail
-
Ask HN: What are some unpopular technologies you wish people knew more about?
Firejail is cool: https://github.com/netblue30/firejail
Linux namespaces/cgroups but nowhere near as heavy as Docker.
I use it when I want to limit the memory of a Python script:
```
-
Toolship: A (More) Secure Workstation
Firejail can also be a useful option, though no good if you're on Mac https://firejail.wordpress.com/
Uses the same Linux primitives as docker etc, but can be a bit more ergonomic for this use case
-
Firejail: Light, featureful and zero-dependency security sandbox for Linux
Firejail, Flatpak (which uses Bubblewrap under the hood), and Snap (which uses AppArmor) all use the same underlying technology: Linux namespaces.
This question comes up a lot, and has been answered here: https://github.com/netblue30/firejail/wiki/Frequently-Asked-...
TL;DR: Firejail has much more comprehensive features than Flatpak (Bubblewrap). Firejail also has more comprehensive network support, support for AppArmor and SELinux, and easier seccomp filtering.
Compared to Snap (which uses AppArmor), Firejail is compatible with AppArmor and again goes above and beyond with a lot of additional features.
-
Bubblewrap – Low-level unprivileged sandboxing tool used by Flatpak
Wonderful little tool, too bad you must chain various exec calling tools to get cgroups (a bit akin to `ionice ... nice ... cmd`) and Linux users namespaces can't allow UNIX sockets while preventing network access (I think?).
Migrated from Firejail when its complexity annoyed me too much and I hit https://github.com/netblue30/firejail/issues/3001 (Firejail doesn't like parens or brackets in --put/--get parameters) to a badly NIH version using bwrap and bash to have "profiles":
- Firejail: Light featureful and zero-dependency security sandbox for Linux
-
Do, or do not. There is no try
Firejail does this. The profile database is the two "profile" directories in https://github.com/netblue30/firejail/tree/master/etc
-
Strange times make for strange friends...
What do you mean by a Firefox container? Do you mean FireJail?
What are some alternatives?
mlvwm - Macintosh-like Virtual Window Manager (official repo)
bubblewrap - Low-level unprivileged sandboxing tool used by Flatpak and similar projects
NsCDE - Modern and functional CDE desktop based on FVWM
flatpak - Linux application sandboxing and distribution framework
xcape - Linux utility to configure modifier keys to act as other keys when pressed and released on their own.
bubblejail - Bubblewrap based sandboxing for desktop applications
dxvk-native - D3D9/11 but it runs natively on Linux!
Flatseal - Manage Flatpak permissions
OpenBSD-Games-Database - Database of games that run on OpenBSD
yabai - A tiling window manager for macOS based on binary space partitioning
Perimeter
podman - Podman: A tool for managing OCI containers and pods.