Re:Firejail – Sandbox Linux Applications
by tetraodonpuffer on Tuesday November 10, 2020 @06:54PM
(#25053758)
Looks interesting but what I don’t understand is if it really is sandboxed, how would a Firefox know that there is another Firefox running and open a tab there (as per the FAQ) instead of a new Firefox in a different sandbox?
[ Parent
| on HN ]
Re:Firejail – Sandbox Linux Applications
by pdonis on Tuesday November 10, 2020 @07:07PM
(#25053880)
The "sandboxing", as I understand it, only applies to the filesystem; processes can still see other processes run in different firejails if they are being run by the same user.
Re:Firejail – Sandbox Linux Applications
by tetraodonpuffer on Tuesday November 10, 2020 @07:25PM
(#25054043)
Sure you could see them, after all you can do a ps and see all processes, but shouldn’t the IPC between firejails be forbidden? How is firejail 2 talking to firejail 1?
Re:Firejail – Sandbox Linux Applications
by jlgaddis on Tuesday November 10, 2020 @09:15PM
(#25054834)
> ... after all you can do a ps and see all processes ...
Which you can prevent by mounting /proc with the "hidepid" option.
Re:Firejail – Sandbox Linux Applications
by pdonis on Tuesday November 10, 2020 @10:29PM
(#25055201)
> shouldn’t the IPC between firejails be forbidden?
I think it depends on what kind of IPC. I'm not familiar enough with the details of how Firefox does it to know how that would interact with firejails.
Re:Firejail – Sandbox Linux Applications
by trulyrandom on Wednesday November 11, 2020 @06:57AM
(#25057620)
Unless not possible due to requirements of a specific program, firejails have their own PID namespace and can only see themselves.