News for hackers. Stuff that matters.

A comment on NsJail: A light-weight process isolation tool for Linux. Parent comment

Re:NsJail: A light-weight process isolation tool for Linux by a-french-anon on Wednesday February 05, 2025 @05:36AM (#42946620)
As a bubblewrap user, beware https://github.com/containers/bubblewrap/pull/586 still missing. The usual ^C doesn't work with your sandboxed stuff, very annoying.

A cursory look at NSjail tells me its filesystem stuff is less granular than bwrap's bind mounting.

Firejail can't handle : in some paths (at all, no escaping provided) which made me dump it.

[ Parent | on HN ]
Re:NsJail: A light-weight process isolation tool for Linux by selendym on Wednesday February 05, 2025 @12:22PM (#42951903)
> Firejail can't handle : in some paths (at all, no escaping provided) which made me dump it.

This doesn't match my experience. For example, the following works just fine in a profile file:

  blacklist /sys/devices/pci0000:00/*
Can you give an example of what you had problems with?
[ Parent | on HN ]
Re:NsJail: A light-weight process isolation tool for Linux by a-french-anon on Thursday February 06, 2025 @03:57AM (#42960477)
Looks like this specific character got fixed. But still a lot of forbidden ones.

cf https://github.com/netblue30/firejail/issues/4614, https://github.com/netblue30/firejail/blob/master/src/fireja... and https://github.com/netblue30/firejail/blob/master/src/lib/co...

[ Parent | on HN ]