And yes, a blank new network namespace won't even have the loopback interface available. There is a program named unshare, which executes a program in another namespace.
Re:Sandboxing with Firejail
by digi_owl on Friday January 22, 2016 @10:28AM
(#10953225)
Really wish there was a basic set of commands for manipulating namespaces. It seems we are reliant on support being baked into larger tools like systemd at present, and said tools may not allow the user/admin to manipulate namespaces directly.
Re:Sandboxing with Firejail
by tobbyb on Friday January 22, 2016 @11:11AM
(#10953517)
The unshare tool [1] can be used along with ip-tools to create a namespace with networking support. Add a chroot or pivot root to it and you have a Linux container. It's quite easy to do. We have a guide on using namespaces directly and the various projects using it including Firejail here [2]
Linux namespaces were created to support containers. This is how userland container projects like LXC, Docker and Nspawn work, only they don't use the unshare tool but the underlying system calls clonens, setns and unshare [3].
Re:Sandboxing with Firejail
by jeswin on Friday January 22, 2016 @09:11AM
(#10952763)
Sorry off topic, but just wanted to check if I can reach you by email. I am building something on those lines, and wanted to see if we can exchange ideas. My email is on my profile.
Re:Sandboxing with Firejail
by e12e on Friday January 22, 2016 @08:20AM
(#10952505)
That doesn't appear to be the same article - so this isn't a duplicate story - just a duplicate (but much more recent) mention of the technology in question.
Re:Sandboxing with Firejail
by satai on Friday January 22, 2016 @06:48AM
(#10952167)
You can do both, there is no need to decide between MAC and firejail.
(It may not work for some small quirks but they should be fixable, at least in theory)
> The --net=none option will create a new network namespace without any devices, so processes cannot communicate outside of the namespace.
No idea what a namespace is, does this mean the process will be unable to use any network? I want that as default for everything on my machine...
And yes, a blank new network namespace won't even have the loopback interface available. There is a program named unshare, which executes a program in another namespace.
Linux namespaces were created to support containers. This is how userland container projects like LXC, Docker and Nspawn work, only they don't use the unshare tool but the underlying system calls clonens, setns and unshare [3].
[1] http://man7.org/linux/man-pages/man2/unshare.2.html
[2] https://www.flockport.com/alternatives-to-docker-and-lxc/
[3] https://lwn.net/Articles/531114/
I guess they can be likened to a surname or such, except that they don't seem to require explicit naming upon creation.