FreeBSD Jails for Fun and Profit (2020)

Re:FreeBSD Jails for Fun and Profit (2020) by tome on Wednesday December 22, 2021 @03:43PM (#29654896)

Could you elaborate on the differences? As far as I understood it firejail, or rather the Linux features that it depends upon, is far more powerful than FreeBSD jails.

[ Parent | on HN ]

Re:FreeBSD Jails for Fun and Profit (2020) by trasz on Wednesday December 22, 2021 @08:23PM (#29657655)

From what I understand, firejail is a "syscall filter". This moves it to the same category as capsicum (https://www.freebsd.org/cgi/man.cgi?capsicum), but without Capsicum's security model, instead implementing something ad-hoc, probably by using Linux' seccmp.

Jails, on the other hand, are not a sandboxing mechanism - they are system-level virtualization, like Linux namespaces, but with a simpler interface. You can use it for sandboxing, but it's not what the mechanism fundamentally is.

[ Parent | on HN ]

Re:FreeBSD Jails for Fun and Profit (2020) by heavyset_go on Wednesday December 22, 2021 @10:41PM (#29658409)

Firejail does more than just syscall filtering.

[ Parent | on HN ]

Re:FreeBSD Jails for Fun and Profit (2020) by trasz on Thursday December 23, 2021 @04:34AM (#29660197)

Please tell more.

[ Parent | on HN ]

Re:FreeBSD Jails for Fun and Profit (2020) by heavyset_go on Thursday December 23, 2021 @10:37PM (#29669854)

Check this out: https://firejail.wordpress.com/features-3/

[ Parent | on HN ]

Re:FreeBSD Jails for Fun and Profit (2020) by trasz on Friday December 24, 2021 @07:19AM (#29673016)

Looks like a GUI wrapper around jails, with some seccmp hacks to work around deficiencies in namespaces.

[ Parent | on HN ]