Firejail

Not a firewall, but Firejail is a great sandboxing tool for Linux. https://firejail.wordpress.com/

Not the best isolation however because containers aren't sandboxes (yet). If you're really serious you need to run something like https://firejail.wordpress.com .

True. If running Firefox in Linux, I'd also recommend to use application sandboxing facilities provided by the kernel. For example, with Firejail [1] (completely unrelated to Firefox) one can do firejail <application> to run a sandboxed instance. Firejail comes bundled with rules for many applications to limit the files they can view from each sandboxed container. In case of a security breach, that keeps data leaks under control. E.g., an attacker might be able to steal stuff from your Firefox instance, but not from your home directory. [1] https://firejail.wordpress.com/

I am just its (mostly happy) user. I wrote that rule on my phone so you are right, it is not complete. On the other hand raw sockets require CAP_NET_RAW capability which is often assigned to root only so running a capability-untreated binary as an unprivileged user should not allow any raw socket ops (ping often uses file capabilities or setuid root). AFAIK it requires root to load/reload profiles. And that is fine for me, my use-case is hardening of services running on my server. For ad-hoc restriction of untrusted software you can already use stuff like FireJail https://firejail.wordpress.com/ But I agree that software developers know their software the best so they should be the ones writing the rules and ideally configure them depending on automake/configure paths (i.e. different PREFIX, this software/profile separation is annoying) but pledge() looks too old and non-flexible for such a job IMO. Most software need file ops but don't need to write everywhere.

I do use Linux (almost) exclusively, but I'm well aware of the security limitations. Forget this keylogger. All you need is to somehow write a single line into .profile or .bashrc, which basically every executed program can do, and you own the user account. You can intercept every program with wrappers by changing PATH or adding desktop entries in .local/share/applications, extract all data from applications, use LD_PRELOAD like shown in the submission ... the possibilities are endless. There isn't even a single decent dynamic firewall with those annoying popups. Apart from SELinux, there is also firejail [1], which I use to sandbox browsers. Flatpak and Snap are also trying to solve both the packaging and the sandboxing aspect, with moderate success. They also increase the risk due to lack of centralized package ownership, so require a very solid sandbox. The only reason why the Linux desktop is somewhat secure is the reliance on official package repos, the trustworthiness of the open source communities, and the and the relatively small target group. I do believe that the path forward has to be Mac OS/Android/iOS style sandboxing - especially for everything not directly from an official repo, but there seems to be relatively little interest in the ecosystem. Non Linux specific sidenote: ever notice how many VS Code extensions download random binaries from the net? Or just that they can execute arbitrary code? Compromising one of those could lead to some glorious…

True there's no sandboxing by default on a typical linux desktop but I think the key difference between the linux distributions and Android security models is that your linux distribution is supposed to run trusted free software whereas your Android device is probably going to run some proprieatary untrusted apps. That's why sandboxing is very necessary on Android and not so much on your linux box. Now I agree you should sanbox everytime you can especially when linux is well capable of it, that's why I use firejail on my desktops so I get all the awesomeness of my favorite distributions AND strong sandboxing with real ease of use. https://firejail.wordpress.com/ One cool trick is to hook "sudo firecfg" in your package manager post operations so whenever you install new software it get sanboxed if a firejail profile is available (which is generally true). There may be a smarter way to do just that though? That xkcd post makes a very good point indeed (that's why everybody should lock whenever afk, encrypt and use strong passwords of course) But I also think you should also worry about those backdoor issues: https://www.replicant.us/freedom-privacy-security-issues.php https://libreboot.org/faq.html#intel

I've done some experimenting with running a local model with ollama and claude code connecting to it and having both in a firejail: https://firejail.wordpress.com/ What they get access to is very limited, and mostly whitelisted.

Fore Linux firejail works well https://firejail.wordpress.com/

Have you tried Firejail security sandbox: https://firejail.wordpress.com/

Firejail can also be a useful option, though no good if you're on Mac https://firejail.wordpress.com/ Uses the same Linux primitives as docker etc, but can be a bit more ergonomic for this use case

You can use Flatpaks to basically solve this issue. Most applications nowadays are already available as Flatpaks, the ones that aren't probably have been reviewed by your distribution. Stick to official repositories and there shouldn't be any worries really. Of course for the average user this kind of discipline might be impossible, but for power-users out there: https://firejail.wordpress.com/ You could also play a bit with writing SELinux or AppArmor policies, although I grant that most people don't give a fuck and just want to get their computing done. Opting for a Wayland-compliant display server instead of XOrg will also provide you with similar benefits such as preventing applications from capturing your key-presses without you knowing or recording your screen without your permission.

Could the CLI tool be combined with something like firejail [1] to solve the filesystem blindspot issue? [1] https://firejail.wordpress.com/

> I like Android's system of per-app uid/gid. But AFAIK it's not implemented by any mainstream Linux kernel or distro. You can create users manually for each app. For GUI apps, https://firejail.wordpress.com/

Ideally you would sandbox this with: 1. No filesystem access 2. No network access 3. Input passed on stdin (or a pre-opened fd) 4. Output passed to stdout (or a pre-opened fd) 5. A hard timeout specified before the process is killed Suddenly bam, dramatically safer. If you're looking for a tool that can do all of this for you, check out firejail: https://firejail.wordpress.com/ It has a ton of options, but you can do all of what I suggested and more, really easily.

Because it's a legitimate behaviour. htop needs to do this, it's literally its main feature. You can use hidepid=2 to prevent users from seeing other user's processes list.[1] But I don't want my OS to ask me "do you want to allow htop to access the list of your processes" — à la Windows Vista — every time I want to run htop to see my user processes. The issue here is closed source software with no way to inspect what they do. If one really want to run closed source programs which were not vetted by their distro's maintainers, they should use firejail.[2] [1] https://www.cyberciti.biz/faq/linux-hide-processes-from-other-users/ [2] https://firejail.wordpress.com/

How could X11 applications be sandboxed? Maybe Firejail? https://firejail.wordpress.com/ Does some packaging format already include X11 sandboxing?

Have you looked at Firejail? It presents several options to contain applications, working on existing packages and AppImages. You could see it as a more easily configured verfsion of the security parts of Flatpaks without the application parts. https://firejail.wordpress.com/

You can run zoom, and skype for that matter, using firejail [1]. There can be glitches now and then, in my cases only with skype IIRC, but it's rare and usually quickly fixed (just update your local configuration from upstream). [1] https://firejail.wordpress.com/

The modern Linux kernel allows you to sandbox applications natively. There are tools that make this easy to set up, for instance [1]. [0]: https://blog.cloudflare.com/sandboxing-in-linux-with-zero-lines-of-cod… [1]: https://firejail.wordpress.com/

Firejail[1] is IMO a good alternative. It handles sandboxing using Linux namespaces and seccomp-bpf. [1] https://firejail.wordpress.com/

For non-opensource applications (e.g. Zoom) I really like using Firejail[0] to run them within a sandbox. Firejail ships with a good set of default policies which make it explicit what the application gets access to. The filesystem sandboxing is especially comforting. [0]: https://firejail.wordpress.com/

Via CLI you can, but GUI apps connect to your X server session, and then the fun begins - any application you allow to connect can essentially capture your keyboard, mouse, clipboard and a ton of other fun things,as there is no sandboxing applied between them. It's inherent in the design of the X protocol. There are solutions that are intended to force the sandboxing by opening a new Xserver for every application, e.g. Firejail [0], but that comes with another set of interoperability problems. Wayland was supposed to address some of these concerns, but it will only do so for applications that natively talk wayland protocol, not the ones that connect through x-protocol via xwayland [0] https://firejail.wordpress.com/

Firejail ( https://firejail.wordpress.com ) offers an easy way to start a completely fresh and rather isolated instance of a browser, and probably after a little bit of work to use various different "complete profiles" (home directories...). Even without any political interference "War is a racket"! ( https://en.wikipedia.org/wiki/War_Is_a_Racket )

If security is your concern, you can run the browser inside a container: https://github.com/ConSol/docker-headless-vnc-container You can also use: https://browsergap.dosyago.com/ There is also: https://firejail.wordpress.com/

I use Firejail[0] on my Linux machine to achieve the same effect. [0] https://firejail.wordpress.com/

On the sandboxing front, it works great with Firejail: https://firejail.wordpress.com/documentation-2/appimage-support/

> Firejail is a SUID program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces and seccomp-bpf. It allows a process and all its descendants to have their own private view of the globally shared kernel resources, such as the network stack, process table, mount table. https://firejail.wordpress.com/

+1 for firejail [1]. There's a guide on how to do this for firefox [2] (see the network setup section), but this can be used with other applications as well. [1] https://firejail.wordpress.com/ [2] https://firejail.wordpress.com/documentation-2/firefox-guide/

as already mentioned, Firejail https://firejail.wordpress.com/ is easy to use and was made at first to run Firefox in a sandbox. It has pretty neat options and can isolate the FS, make use of a temporary home etc.

Well there’s docker. You’d have to expose X to the container ( http://fabiorehm.com/blog/2014/09/11/running-gui-apps-with-docker/ ) Or https://www.flatpak.org/ Edit: hmm apparently there’s also https://firejail.wordpress.com/