Skip to content

Sandboxing browsers

zin/onzin van browser in een zandbak ?
zoeken op : linux privacy browser // isolate user data

https://easylinuxtipsproject.blogspot.com/p/sandbox.html check firejail & alternativess
https://firejail.wordpress.com/2017/05/13/linux-com-4-best-practices-for-web-browser-security-on-your-linux-workstation/

Firejail is de meest populaire blijkbaar
alternatieven ?

pro

browsers are the principal thread on a laptop (biggest surface attack)
any extra protection is welcome
quid mail ?

con

  • only file attachments from/to sandboxed location (not really an issue , in my opinion)
  • er is discussie over het nut :
    interessante discussie :
    Firejails attack surface is significantly larger than that of Bubblewrap, which in turn is significantly larger than something like Apparmor with unprivileged user namespaces disabled.
    If local privilege escalation vulnerabilities are a primary concern, I would always opt for the latter. Not without reason does the kernel restrict comprehensive sandbox configuration to the root user. It is possible to give these powers to ordinary users, which is what both Firejail and Bubblewrap do, but it is not possible to do so without increasing the system attack surface in one way or the other.
    Just to put the content of your links somewhat into perspective. Anyways, I’m not really sure how relevant all this is for ordinary desktop users. On a usual desktop, the game is over long before an attacker starts looking for broken SETUID binaries… because user data is the real trophy, and to defend this data you need to get the sandbox configuration right. I’m slightly surprised this discussion got this far without a reference to the relevant xkcd:
    https://imgs.xkcd.com/comics/authorization.png
    Turns out, for many users it does not matter that much which tool they are choosing. But depending on your specs, some tools may indeed fit better than others.
    https://www.reddit.com/r/archlinux/comments/eemvea/is_firejail_safe_if_not_what_options_are_better/

types

Apparmor versus firejail (twee verschillende aanpak)
bijvb.
https://www.funkyspacemonkey.com/introduction-to-apparmor-and-firejail