What is Firejail?

Firejail is an open source sandbox program for Linux operating systems. It uses security features built into the Linux kernel, such as namespaces and seccomp-bpf filters, to restrict the environment that an application can access.

When an application is launched using Firejail, it is restricted to its own filesystem namespace, limited networking access, and reduced access to other system resources. This prevents untrusted or potentially malicious applications from accessing sensitive parts of the system.

Some key features of Firejail include:

• Filesystem sandboxing - applications can only access their own home directory and whitelisted directories, preventing access to sensitive system files
• Network sandboxing - restricted network access prevents applications from opening unwanted connections
• Seccomp filter support - syscall filtering further locks down what sandboxed processes can do
• X11 sandboxing - X11 access can be constrained to prevent spying on X11 keystrokes and screen grabs
• Profile support - default security profiles for common Linux programs to easily sandbox untrusted apps
• Easy to use - simple command line interface, integrates well with desktop menus

Firejail aims to make Linux application sandboxing easy to use for desktop users. The sandboxing restricts the damage malware or exploits in apps can inflict on a system. It can also mitigate leaky apps from accessing more resources than necessary.

Official Links