News for hackers. Stuff that matters.

A comment on Nsjail – A light-weight process isolation tool for Linux. Parent comment

Re:Nsjail – A light-weight process isolation tool for Linux by moosingin3space on Sunday October 15, 2017 @03:58PM (#15478977)
This tool is lighter-weight than firejail. nsjail seems to be a thin abstraction over Linux namespaces, while firejail contains profiles for common desktop applications and some X hackery to enable jailing of GUI programs.
[ Parent | on HN ]
Re:Nsjail – A light-weight process isolation tool for Linux by jagger11 on Sunday October 15, 2017 @05:56PM (#15479538)
author here:

Yup, nsjail doesn't have X hacks (I should work on that), though it offers some profiles for Apache-like type of applications:

https://github.com/google/nsjail/tree/master/configs

I believe nsjail uses one of the most advanced (if not the most advanced) seccomp-bpf config language - kafel: https://github.com/google/kafel

[ Parent | on HN ]
Re:Nsjail – A light-weight process isolation tool for Linux by audidude on Monday October 16, 2017 @12:46AM (#15480881)
bwrap allows passing a FD containing the seccomp rules (--seccomp FD w/ seccomp_export_bpf). If it can export the compiled eBPF it should be trivial to use kafel profiles w/ bubblewrap/atomic/flatpak/etc.
[ Parent | on HN ]