aboutsummaryrefslogtreecommitdiffstats
path: root/src/man/firejail.1.in
diff options
context:
space:
mode:
authorLibravatar Kelvin M. Klann <kmk3.code@protonmail.com>2023-07-12 01:55:07 -0300
committerLibravatar Kelvin M. Klann <kmk3.code@protonmail.com>2023-07-13 11:43:53 -0300
commit76bd5ad0f8347bc111c30f67b2eb151c2e5870ed (patch)
tree3fd235c83d6ce45451abc80dca27420203d3aad6 /src/man/firejail.1.in
parentbuild: restore seccomp filter targets (diff)
downloadfirejail-76bd5ad0f8347bc111c30f67b2eb151c2e5870ed.tar.gz
firejail-76bd5ad0f8347bc111c30f67b2eb151c2e5870ed.tar.zst
firejail-76bd5ad0f8347bc111c30f67b2eb151c2e5870ed.zip
build: simplify code related to man pages
Simplify the main targets and use wildcards instead of repeating the filenames manually. Also, restore the `man` target and building only when `HAVE_MAN` is enabled. Note: Make automatically removes intermediate files (.1 and .5), so in general only the .gz files have to be cleaned. Commands used to rename the man pages: cd src/man git mv firecfg.txt firecfg.1.in git mv firejail-login.txt firejail-login.5.in git mv firejail-profile.txt firejail-profile.5.in git mv firejail-users.txt firejail-users.5.in git mv firejail.txt firejail.1.in git mv firemon.txt firemon.1.in git mv jailcheck.txt jailcheck.1.in This is kind of a follow-up to commit 9e206b7f2 ("rework src/man Makefile", 2023-07-07).
Diffstat (limited to 'src/man/firejail.1.in')
-rw-r--r--src/man/firejail.1.in3803
1 files changed, 3803 insertions, 0 deletions
diff --git a/src/man/firejail.1.in b/src/man/firejail.1.in
new file mode 100644
index 000000000..19fc94ebd
--- /dev/null
+++ b/src/man/firejail.1.in
@@ -0,0 +1,3803 @@
1.TH FIREJAIL 1 "MONTH YEAR" "VERSION" "firejail man page"
2.SH NAME
3Firejail \- Linux namespaces sandbox program
4.SH SYNOPSIS
5Start a sandbox:
6.PP
7.RS
8firejail [OPTIONS] [program and arguments]
9.RE
10.PP
11Start an AppImage program:
12.PP
13.RS
14firejail [OPTIONS] --appimage [OPTIONS] [appimage-file and arguments]
15.RE
16.PP
17#ifdef HAVE_FILE_TRANSFER
18File transfer from an existing sandbox
19.PP
20.RS
21firejail {\-\-ls | \-\-get | \-\-put | \-\-cat} dir_or_filename
22.RE
23.PP
24#endif
25#ifdef HAVE_NETWORK
26Network traffic shaping for an existing sandbox:
27.PP
28.RS
29firejail \-\-bandwidth={name|pid} bandwidth-command
30.RE
31.PP
32#endif
33Monitoring:
34.PP
35.RS
36firejail {\-\-list | \-\-netstats | \-\-top | \-\-tree}
37.RE
38.PP
39Miscellaneous:
40.PP
41.RS
42firejail {\-? | \-\-debug-caps | \-\-debug-errnos | \-\-debug-syscalls | \-\-debug-syscalls32 | \-\-debug-protocols | \-\-help | \-\-version}
43.RE
44.SH DESCRIPTION
45#ifdef HAVE_LTS
46This is Firejail long-term support (LTS), an enterprise focused version of the software,
47LTS is usually supported for two or three years.
48During this time only bugs and the occasional documentation problems are fixed.
49The attack surface of the SUID executable was greatly reduced by removing some of the features.
50.br
51
52.br
53#endif
54Firejail is a SUID sandbox program that reduces the risk of security breaches by
55restricting the running environment of untrusted applications using Linux
56namespaces, seccomp-bpf and Linux capabilities.
57It allows a process and all its descendants to have their own private view of the
58globally shared kernel resources, such as the network stack, process table, mount table.
59Firejail can work in a SELinux or AppArmor environment,
60and it is integrated with Linux Control Groups.
61.PP
62Written in C with virtually no dependencies, the software runs on any Linux computer with a 3.x kernel version
63or newer.
64It can sandbox any type of processes: servers, graphical applications, and even user login sessions.
65.PP
66Firejail allows the user to manage application security using security profiles.
67Each profile defines a set of permissions for a specific application or group
68of applications. The software includes security profiles for a number of more common
69Linux programs, such as Mozilla Firefox, Chromium, VLC, Transmission etc.
70.\" TODO: Explain the security/usability tradeoffs from #4601.
71.PP
72Firejail is currently implemented as an SUID binary, which means that if a
73malicious or compromised user account manages to exploit a bug in Firejail,
74that could ultimately lead to a privilege escalation to root.
75To mitigate this, it is recommended to only allow trusted users to run firejail
76(see firejail-users(5) for details on how to achieve that).
77For more details on the security/usability tradeoffs of Firejail, see:
78.UR https://github.com/netblue30/firejail/discussions/4601
79#4601
80.UE
81.PP
82Alternative sandbox technologies like snap (https://snapcraft.io/) and flatpak (https://flatpak.org/)
83are not supported. Snap and flatpak packages have their own native management tools and will
84not work when sandboxed with Firejail.
85
86.SH USAGE
87Without any options, the sandbox consists of a filesystem build in a new mount namespace,
88and new PID and UTS namespaces. IPC, network and user namespaces can be added using the
89command line options. The default Firejail filesystem is based on the host filesystem with the main
90system directories mounted read-only. These directories are /etc, /var, /usr, /bin, /sbin, /lib, /lib32,
91/libx32 and /lib64. Only /home and /tmp are writable.
92.PP
93Upon execution Firejail first looks in ~/.config/firejail/ for a profile and if it doesn't find one, it looks in /etc/firejail/.
94For profile resolution detail see https://github.com/netblue30/firejail/wiki/Creating-Profiles#locations-and-types.
95If an appropriate profile is not found, Firejail will use a default profile.
96The default profile is quite restrictive. In case the application doesn't work, use --noprofile option
97to disable it. For more information, please see \fBSECURITY PROFILES\fR section below.
98.PP
99If a program argument is not specified, Firejail starts the user's preferred shell.
100Examples:
101.PP
102$ firejail [OPTIONS] # starting the program specified in $SHELL, usually /bin/bash
103.PP
104$ firejail [OPTIONS] firefox # starting Mozilla Firefox
105.PP
106# sudo firejail [OPTIONS] /etc/init.d/nginx start
107
108.SH OPTIONS
109.TP
110\fB\-\-
111Signal the end of options and disables further option processing.
112.TP
113\fB\-\-allow-debuggers
114Allow tools such as strace and gdb inside the sandbox by whitelisting
115system calls ptrace and process_vm_readv. This option is only
116available when running on Linux kernels 4.8 or newer - a kernel bug in
117ptrace system call allows a full bypass of the seccomp filter.
118.br
119
120.br
121Example:
122.br
123$ firejail --allow-debuggers --profile=/etc/firejail/firefox.profile strace -f firefox
124.TP
125\fB\-\-allusers
126All directories under /home are visible inside the sandbox. By default, only current user home directory is visible.
127.br
128
129.br
130Example:
131.br
132$ firejail --allusers
133#ifdef HAVE_APPARMOR
134.TP
135\fB\-\-apparmor
136Enable AppArmor confinement with the "firejail-default" AppArmor profile.
137For more information, please see \fBAPPARMOR\fR section below.
138.TP
139\fB\-\-apparmor=profile_name
140Enable AppArmor confinement with a custom AppArmor profile.
141Note that profile in question must already be loaded into the kernel.
142For more information, please see \fBAPPARMOR\fR section below.
143.TP
144\fB\-\-apparmor.print=name|pid
145Print the AppArmor confinement status for the sandbox identified by name or by PID.
146.br
147
148.br
149Example:
150.br
151$ firejail \-\-apparmor.print=browser
152.br
1535074:netblue:/usr/bin/firejail /usr/bin/firefox-esr
154.br
155 AppArmor: firejail-default enforce
156#endif
157.TP
158\fB\-\-appimage
159Sandbox an AppImage (https://appimage.org/) application. If the sandbox is started
160as a regular user, nonewprivs and a default capabilities filter are enabled.
161private-bin and private-lib are disabled by default when running appimages.
162.br
163
164.br
165Example:
166.br
167$ firejail --appimage --profile=krita krita-3.0-x86_64.appimage
168.br
169$ firejail --quiet --appimage --private --profile=krita krita-3.0-x86_64.appimage
170.br
171#ifdef HAVE_X11
172$ firejail --appimage --net=none --x11 --profile=krita krita-3.0-x86_64.appimage
173#endif
174.br
175
176.br
177Note: When using both \fB--appimage\fR and \fB--profile\fR, it is recommended
178to always specify the former before the latter, so that any \fB?HAS_APPIMAGE\fR
179conditionals inside of the profile evaluate to true (see \fB?CONDITIONAL\fR in
180firejail-profile(5)).
181#ifdef HAVE_NETWORK
182.TP
183\fB\-\-bandwidth=name|pid
184Set bandwidth limits for the sandbox identified by name or PID, see \fBTRAFFIC SHAPING\fR section for more details.
185#endif
186.TP
187\fB\-\-bind=filename1,filename2
188Mount-bind filename1 on top of filename2. This option is only available when running as root.
189.br
190
191.br
192Example:
193.br
194# firejail \-\-bind=/config/etc/passwd,/etc/passwd
195.TP
196\fB\-\-blacklist=dirname_or_filename
197Blacklist directory or file. File globbing is supported, see \fBFILE GLOBBING\fR section for more details.
198.br
199
200.br
201Symbolic link handling: Blacklisting a path that is a symbolic link will also
202blacklist the path that it points to.
203For example, if ~/foo is blacklisted and it points to /bar, then /bar will also
204be blacklisted.
205.br
206
207.br
208Example:
209.br
210$ firejail \-\-blacklist=/sbin \-\-blacklist=/usr/sbin
211.br
212$ firejail \-\-blacklist=~/.mozilla
213.br
214$ firejail "\-\-blacklist=/home/username/My Virtual Machines"
215.br
216$ firejail \-\-blacklist=/home/username/My\\ Virtual\\ Machines
217.TP
218\fB\-\-build
219The command builds a whitelisted profile. The profile is printed on the screen. The program is run in a very relaxed sandbox, with only \-\-caps.drop=all and \-\-seccomp=!chroot. Programs that raise user privileges are not supported.
220.br
221
222.br
223Example:
224.br
225$ firejail \-\-build vlc ~/Videos/test.mp4
226.br
227$ firejail \-\-build \-\-appimage ~/Downloads/Subsurface.AppImage
228.TP
229\fB\-\-build=profile-file
230The command builds a whitelisted profile, and saves it in profile-file. The program is run in a very relaxed sandbox,
231with only \-\-caps.drop=all and \-\-seccomp=!chroot. Programs that raise user privileges are not supported.
232.br
233
234.br
235Example:
236.br
237$ firejail \-\-build=vlc.profile vlc ~/Videos/test.mp4
238.br
239$ firejail \-\-build=Subsurface.profile \-\-appimage ~/Downloads/Subsurface.AppImage
240.TP
241\fB\-c
242Login shell compatibility option. This option is use by some login programs when executing
243the login shell, such as when firejail is used as a restricted login shell. It currently does
244not change the execution of firejail.
245.TP
246\fB\-\-caps
247Linux capabilities is a kernel feature designed to split up the root privilege into a set of distinct privileges.
248These privileges can be enabled or disabled independently, thus restricting what a process running
249as root can do in the system.
250See capabilities(7) for details.
251
252By default root programs run with all capabilities enabled. \-\-caps option disables the following capabilities:
253CAP_SYS_MODULE, CAP_SYS_RAWIO,
254CAP_SYS_BOOT, CAP_SYS_NICE, CAP_SYS_TTY_CONFIG, CAP_SYSLOG, CAP_MKNOD, CAP_SYS_ADMIN.
255The filter is applied to all processes started in the sandbox.
256.br
257
258.br
259Example:
260.br
261$ sudo firejail \-\-caps /etc/init.d/nginx start
262
263.TP
264\fB\-\-caps.drop=all
265Drop all capabilities for the processes running in the sandbox. This option is recommended for running GUI programs
266or any other program that doesn't require root privileges. It is a must-have option for sandboxing untrusted programs
267installed from unofficial sources - such as games, Java programs, etc.
268.br
269
270.br
271Example:
272.br
273$ firejail \-\-caps.drop=all warzone2100
274
275.TP
276\fB\-\-caps.drop=capability,capability,capability
277Define a custom blacklist Linux capabilities filter.
278.br
279
280.br
281Example:
282.br
283$ firejail \-\-caps.drop=net_broadcast,net_admin,net_raw
284
285.TP
286\fB\-\-caps.keep=capability,capability,capability
287Define a custom whitelist Linux capabilities filter.
288.br
289
290.br
291Example:
292.br
293$ sudo firejail \-\-caps.keep=chown,net_bind_service,setgid,\\
294setuid /etc/init.d/nginx start
295
296.TP
297\fB\-\-caps.print=name|pid
298Print the caps filter for the sandbox identified by name or by PID.
299.br
300
301.br
302Example:
303.br
304$ firejail \-\-name=mygame \-\-caps.drop=all warzone2100 &
305.br
306$ firejail \-\-caps.print=mygame
307.br
308
309.br
310Example:
311.br
312$ firejail \-\-list
313.br
3143272:netblue::firejail \-\-private firefox
315.br
316$ firejail \-\-caps.print=3272
317
318#ifdef HAVE_FILE_TRANSFER
319.TP
320\fB\-\-cat=name|pid filename
321Print content of file from sandbox container, see FILE TRANSFER section for more details.
322#endif
323#ifdef HAVE_CHROOT
324.TP
325\fB\-\-chroot=dirname
326Chroot the sandbox into a root filesystem. Unlike the regular filesystem container,
327the system directories are mounted read-write. If the sandbox is started as a
328regular user, nonewprivs and a default capabilities filter are enabled.
329.br
330
331.br
332Example:
333.br
334$ firejail \-\-chroot=/media/ubuntu warzone2100
335.br
336
337.br
338For automatic mounting of X11 and PulseAudio sockets set environment variables
339FIREJAIL_CHROOT_X11 and FIREJAIL_CHROOT_PULSE.
340.br
341
342.br
343Note: Support for this command is controlled in firejail.config with the
344\fBchroot\fR option.
345#endif
346.TP
347\fB\-\-cpu=cpu-number,cpu-number,cpu-number
348Set CPU affinity.
349.br
350
351.br
352Example:
353.br
354$ firejail \-\-cpu=0,1 handbrake
355
356.TP
357\fB\-\-cpu.print=name|pid
358Print the CPU cores in use by the sandbox identified by name or by PID.
359.br
360
361.br
362Example:
363.br
364$ firejail \-\-name=mygame \-\-caps.drop=all warzone2100 &
365.br
366$ firejail \-\-cpu.print=mygame
367.br
368
369.br
370Example:
371.br
372$ firejail \-\-list
373.br
3743272:netblue::firejail \-\-private firefox
375.br
376$ firejail \-\-cpu.print=3272
377#ifdef HAVE_DBUSPROXY
378.TP
379\fB\-\-dbus-log=file
380Specify the location for the DBus log file.
381.br
382
383.br
384The log file contains events for both the system and session buses if both of
385the --dbus-system.log and --dbus-user.log options are specified. If no log file
386path is given, logs are written to the standard output instead.
387.br
388
389.br
390Example:
391.br
392$ firejail --dbus-system=filter --dbus-system.log \\
393.br
394--dbus-log=dbus.txt
395
396.TP
397\fB\-\-dbus-system=filter|none
398Set system DBus sandboxing policy.
399.br
400
401.br
402The \fBfilter\fR policy enables the system DBus filter. This option requires
403installing the xdg-dbus-proxy utility. Permissions for well-known can be
404specified with the --dbus-system.talk and --dbus-system.own options.
405.br
406
407.br
408The \fBnone\fR policy disables access to the system DBus.
409.br
410
411.br
412Only the regular system DBus UNIX socket is handled by this option. To disable
413the abstract sockets (and force applications to use the filtered UNIX socket)
414you would need to request a new network namespace using \-\-net command. Another
415option is to remove unix from the \-\-protocol set.
416.br
417
418.br
419Example:
420.br
421$ firejail \-\-dbus-system=none
422
423.TP
424\fB\-\-dbus-system.broadcast=name=[member][@path]
425Allows the application to receive broadcast signals from the indicated interface
426member at the indicated object path exposed by the indicated bus name on the
427system DBus.
428The name may have a .* suffix to match all names underneath it, including
429itself.
430The interface member may have a .* to match all members of an interface, or be * to match all interfaces.
431The path may have a /* suffix to indicate all objects underneath it, including
432itself.
433Omitting the interface member or the object path will match all members and
434object paths, respectively.
435.br
436
437.br
438Example:
439.br
440$ firejail --dbus-system=filter --dbus-system.broadcast=\\
441.br
442org.freedesktop.Notifications=\\
443.br
444org.freedesktop.Notifications.*@/org/freedesktop/Notifications
445
446.TP
447\fB\-\-dbus-system.call=name=[member][@path]
448Allows the application to call the indicated interface member at the indicated
449object path exposed by the indicated bus name on the system DBus.
450The name may have a .* suffix to match all names underneath it, including
451itself.
452The interface member may have a .* to match all members of an interface, or be * to match all interfaces.
453The path may have a /* suffix to indicate all objects underneath it, including
454itself.
455Omitting the interface member or the object path will match all members and
456object paths, respectively.
457.br
458
459.br
460Example:
461.br
462$ firejail --dbus-system=filter --dbus-system.call=\\
463.br
464org.freedesktop.Notifications=\\
465.br
466org.freedesktop.Notifications.*@/org/freedesktop/Notifications
467
468.TP
469\fB\-\-dbus-system.log
470Turn on DBus logging for the system DBus. This option requires --dbus-system=filter.
471
472.br
473Example:
474.br
475$ firejail --dbus-system=filter --dbus-system.log
476
477.TP
478\fB\-\-dbus-system.own=name
479Allows the application to own the specified well-known name on the system DBus.
480The name may have a .* suffix to match all names underneath it, including itself
481(e.g. "foo.bar.*" matches "foo.bar", "foo.bar.baz" and "foo.bar.baz.quux", but
482not "foobar").
483.br
484
485.br
486Example:
487.br
488$ firejail --dbus-system=filter --dbus-system.own=\\
489.br
490org.gnome.ghex.*
491
492.TP
493\fB\-\-dbus-system.see=name
494Allows the application to see, but not talk to the specified well-known name on
495the system DBus.
496The name may have a .* suffix to match all names underneath it, including itself
497(e.g. "foo.bar.*" matches "foo.bar", "foo.bar.baz" and "foo.bar.baz.quux", but
498not "foobar").
499.br
500
501.br
502Example:
503.br
504$ firejail --dbus-system=filter --dbus-system.see=\\
505.br
506org.freedesktop.Notifications
507
508.TP
509\fB\-\-dbus-system.talk=name
510Allows the application to talk to the specified well-known name on the system DBus.
511The name may have a .* suffix to match all names underneath it, including itself
512(e.g. "foo.bar.*" matches "foo.bar", "foo.bar.baz" and "foo.bar.baz.quux", but
513not "foobar").
514.br
515
516.br
517Example:
518.br
519$ firejail --dbus-system=filter --dbus-system.talk=\\
520.br
521org.freedesktop.Notifications
522
523.TP
524\fB\-\-dbus-user=filter|none
525Set session DBus sandboxing policy.
526.br
527
528.br
529The \fBfilter\fR policy enables the session DBus filter. This option requires
530installing the xdg-dbus-proxy utility. Permissions for well-known names can be
531added with the --dbus-user.talk and --dbus-user.own options.
532.br
533
534.br
535The \fBnone\fR policy disables access to the session DBus.
536.br
537
538.br
539Only the regular session DBus UNIX socket is handled by this option. To disable
540the abstract sockets (and force applications to use the filtered UNIX socket)
541you would need to request a new network namespace using \-\-net command. Another
542option is to remove unix from the \-\-protocol set.
543.br
544
545.br
546Example:
547.br
548$ firejail \-\-dbus-user=none
549
550.TP
551\fB\-\-dbus-user.broadcast=name=[member][@path]
552Allows the application to receive broadcast signals from the indicated interface
553member at the indicated object path exposed by the indicated bus name on the
554session DBus.
555The name may have a .* suffix to match all names underneath it, including
556itself.
557The interface member may have a .* to match all members of an interface, or be * to match all interfaces.
558The path may have a /* suffix to indicate all objects underneath it, including
559itself.
560Omitting the interface member or the object path will match all members and
561object paths, respectively.
562.br
563
564.br
565Example:
566.br
567$ firejail --dbus-user=filter --dbus-user.broadcast=\\
568.br
569org.freedesktop.Notifications=\\
570.br
571org.freedesktop.Notifications.*@/org/freedesktop/Notifications
572
573.TP
574\fB\-\-dbus-user.call=name=[member][@path]
575Allows the application to call the indicated interface member at the indicated
576object path exposed by the indicated bus name on the session DBus.
577The name may have a .* suffix to match all names underneath it, including
578itself.
579The interface member may have a .* to match all members of an interface, or be * to match all interfaces.
580The path may have a /* suffix to indicate all objects underneath it, including
581itself.
582Omitting the interface member or the object path will match all members and
583object paths, respectively.
584.br
585
586.br
587Example:
588.br
589$ firejail --dbus-user=filter --dbus-user.call=\\
590.br
591org.freedesktop.Notifications=\\
592.br
593org.freedesktop.Notifications.*@/org/freedesktop/Notifications
594
595.TP
596\fB\-\-dbus-user.log
597Turn on DBus logging for the session DBus. This option requires --dbus-user=filter.
598
599.br
600Example:
601.br
602$ firejail --dbus-user=filter --dbus-user.log
603
604.TP
605\fB\-\-dbus-user.own=name
606Allows the application to own the specified well-known name on the session DBus.
607The name may have a .* suffix to match all names underneath it, including itself
608(e.g. "foo.bar.*" matches "foo.bar", "foo.bar.baz" and "foo.bar.baz.quux", but
609not "foobar").
610.br
611
612.br
613Example:
614.br
615$ firejail --dbus-user=filter --dbus-user.own=org.gnome.ghex.*
616
617.TP
618\fB\-\-dbus-user.talk=name
619Allows the application to talk to the specified well-known name on the session DBus.
620The name may have a .* suffix to match all names underneath it, including itself
621(e.g. "foo.bar.*" matches "foo.bar", "foo.bar.baz" and "foo.bar.baz.quux", but
622not "foobar").
623.br
624
625.br
626Example:
627.br
628$ firejail --dbus-user=filter --dbus-user.talk=\\
629.br
630org.freedesktop.Notifications
631
632.TP
633\fB\-\-dbus-user.see=name
634Allows the application to see, but not talk to the specified well-known name on
635the session DBus.
636The name may have a .* suffix to match all names underneath it, including itself
637(e.g. "foo.bar.*" matches "foo.bar", "foo.bar.baz" and "foo.bar.baz.quux", but
638not "foobar").
639.br
640
641.br
642Example:
643.br
644$ firejail --dbus-user=filter --dbus-user.see=\\
645.br
646org.freedesktop.Notifications
647#endif
648.TP
649\fB\-\-debug\fR
650Print debug messages.
651.br
652
653.br
654Example:
655.br
656$ firejail \-\-debug firefox
657
658.TP
659\fB\-\-debug-blacklists\fR
660Debug blacklisting.
661.br
662
663.br
664Example:
665.br
666$ firejail \-\-debug-blacklists firefox
667
668.TP
669\fB\-\-debug-caps
670Print all recognized capabilities in the current Firejail software build and exit.
671.br
672
673.br
674Example:
675.br
676$ firejail \-\-debug-caps
677
678.TP
679\fB\-\-debug-errnos
680Print all recognized error numbers in the current Firejail software build and exit.
681.br
682
683.br
684Example:
685.br
686$ firejail \-\-debug-errnos
687#ifdef HAVE_PRIVATE_LIB
688.TP
689\fB\-\-debug-private-lib
690Debug messages for --private-lib option.
691#endif
692.TP
693\fB\-\-debug-protocols
694Print all recognized protocols in the current Firejail software build and exit.
695.br
696
697.br
698Example:
699.br
700$ firejail \-\-debug-protocols
701.TP
702\fB\-\-debug-syscalls
703Print all recognized system calls in the current Firejail software build and exit.
704.br
705
706.br
707Example:
708.br
709$ firejail \-\-debug-syscalls
710.TP
711\fB\-\-debug-syscalls32
712Print all recognized 32 bit system calls in the current Firejail software build and exit.
713.br
714.TP
715\fB\-\-debug-whitelists\fR
716Debug whitelisting.
717.br
718
719.br
720Example:
721.br
722$ firejail \-\-debug-whitelists firefox
723#ifdef HAVE_NETWORK
724.TP
725\fB\-\-defaultgw=address
726Use this address as default gateway in the new network namespace.
727.br
728
729.br
730Example:
731.br
732$ firejail \-\-net=eth0 \-\-defaultgw=10.10.20.1 firefox
733#endif
734
735.TP
736\fB\-\-deterministic-exit-code
737Always exit firejail with the first child's exit status. The default behavior is to use the exit status of the final child to exit, which can be nondeterministic.
738.br
739
740.TP
741\fB\-\-deterministic-shutdown
742Always shut down the sandbox after the first child has terminated. The default behavior is to keep the sandbox alive as long as it contains running processes.
743.br
744
745.TP
746\fB\-\-disable-mnt
747Blacklist /mnt, /media, /run/mount and /run/media access.
748.br
749
750.br
751Example:
752.br
753$ firejail \-\-disable-mnt firefox
754
755.TP
756\fB\-\-dns=address
757Set a DNS server for the sandbox. Up to three DNS servers can be defined.
758Use this option if you don't trust the DNS setup on your network.
759.br
760
761.br
762Example:
763.br
764$ firejail \-\-dns=8.8.8.8 \-\-dns=8.8.4.4 firefox
765.br
766
767.br
768Note: this feature is not supported on systemd-resolved setups.
769.TP
770\fB\-\-dns.print=name|pid
771Print DNS configuration for a sandbox identified by name or by PID.
772.br
773
774.br
775Example:
776.br
777$ firejail \-\-name=mygame \-\-caps.drop=all warzone2100 &
778.br
779$ firejail \-\-dns.print=mygame
780.br
781
782.br
783Example:
784.br
785$ firejail \-\-list
786.br
7873272:netblue::firejail \-\-private firefox
788.br
789$ firejail \-\-dns.print=3272
790
791#ifdef HAVE_NETWORK
792.TP
793\fB\-\-dnstrace[=name|pid]
794Monitor DNS queries. The sandbox can be specified by name or pid. Only networked sandboxes
795created with \-\-net are supported. This option is only available when running the sandbox as root.
796.br
797
798.br
799Without a name/pid, Firejail will monitor the main system network namespace.
800.br
801
802.br
803Example:
804.br
805$ sudo firejail --dnstrace
806.br
80711:31:43 9.9.9.9 linux.com (type 1)
808.br
80911:31:45 9.9.9.9 fonts.googleapis.com (type 1) NXDOMAIN
810.br
81111:31:45 9.9.9.9 js.hs-scripts.com (type 1) NXDOMAIN
812.br
81311:31:45 9.9.9.9 www.linux.com (type 1)
814.br
81511:31:45 9.9.9.9 fonts.googleapis.com (type 1) NXDOMAIN
816.br
81711:31:52 9.9.9.9 js.hs-scripts.com (type 1) NXDOMAIN
818.br
81911:32:05 9.9.9.9 secure.gravatar.com (type 1)
820.br
82111:32:06 9.9.9.9 secure.gravatar.com (type 1)
822.br
82311:32:08 9.9.9.9 taikai.network (type 1)
824.br
82511:32:08 9.9.9.9 cdn.jsdelivr.net (type 1)
826.br
82711:32:08 9.9.9.9 taikai.azureedge.net (type 1)
828.br
82911:32:08 9.9.9.9 www.youtube.com (type 1)
830.br
831#endif
832
833.TP
834\fB\-\-env=name=value
835Set environment variable in the new sandbox.
836.br
837
838.br
839Example:
840.br
841$ firejail \-\-env=LD_LIBRARY_PATH=/opt/test/lib
842
843.TP
844\fB\-\-fs.print=name|pid
845Print the filesystem log for the sandbox identified by name or by PID.
846.br
847
848.br
849Example:
850.br
851$ firejail \-\-name=mygame \-\-caps.drop=all warzone2100 &
852.br
853$ firejail \-\-fs.print=mygame
854.br
855
856.br
857Example:
858.br
859$ firejail \-\-list
860.br
8613272:netblue::firejail \-\-private firefox
862.br
863$ firejail \-\-fs.print=3272
864
865#ifdef HAVE_FILE_TRANSFER
866.TP
867\fB\-\-get=name|pid filename
868Get a file from sandbox container, see \fBFILE TRANSFER\fR section for more details.
869#endif
870.TP
871\fB\-?\fR, \fB\-\-help\fR
872Print options end exit.
873
874
875.TP
876\fB\-\-hostname=name
877Set sandbox hostname.
878.br
879For valid names, see the \fBNAME VALIDATION\fR section.
880.br
881
882.br
883Example:
884.br
885$ firejail \-\-hostname=officepc firefox
886
887.TP
888\fB\-\-hosts-file=file
889Use file as /etc/hosts.
890.br
891
892.br
893Example:
894.br
895$ firejail \-\-hosts-file=~/myhosts firefox
896
897#ifdef HAVE_IDS
898.TP
899\fB\-\-ids-check
900Check file hashes previously generated by \-\-ids-check. See INTRUSION DETECTION SYSTEM section for more details.
901.br
902
903.br
904Example:
905.br
906$ firejail \-\-ids-check
907
908.TP
909\fB\-\-ids-init
910Initialize file hashes. See INTRUSION DETECTION SYSTEM section for more details.
911.br
912
913.br
914Example:
915.br
916$ firejail \-\-ids-init
917#endif
918
919.TP
920\fB\-\-ignore=command
921Ignore command in profile file.
922.br
923
924.br
925Example:
926.br
927$ firejail --ignore=seccomp --ignore=caps firefox
928#ifdef HAVE_NETWORK
929.br
930$ firejail \-\-ignore="net eth0" firefox
931#endif
932
933#ifdef HAVE_NETWORK
934.TP
935\fB\-\-icmptrace[=name|pid]
936Monitor ICMP traffic. The sandbox can be specified by name or pid. Only networked sandboxes
937created with \-\-net are supported. This option is only available when running the sandbox as root.
938.br
939
940.br
941Without a name/pid, Firejail will monitor the main system network namespace.
942.br
943
944.br
945Example
946.br
947$ sudo firejail --icmptrace
948.br
94920:53:54 192.168.1.60 -> 142.250.65.174 - 98 bytes - Echo request/0
950.br
95120:53:54 142.250.65.174 -> 192.168.1.60 - 98 bytes - Echo reply/0
952.br
95320:53:55 192.168.1.60 -> 142.250.65.174 - 98 bytes - Echo request/0
954.br
95520:53:55 142.250.65.174 -> 192.168.1.60 - 98 bytes - Echo reply/0
956.br
95720:53:55 192.168.1.60 -> 1.1.1.1 - 154 bytes - Destination unreachable/Port unreachable
958.br
959#endif
960
961.TP
962\fB\-\-\include=file.profile
963Include a profile file before the regular profiles are used.
964.br
965
966.br
967Example:
968.br
969$ firejail --include=/etc/firejail/disable-devel.inc gedit
970
971#ifdef HAVE_NETWORK
972.TP
973\fB\-\-interface=interface
974Move interface in a new network namespace. Up to four --interface options can be specified.
975Note: wlan devices are not supported for this option.
976.br
977
978.br
979Example:
980.br
981$ firejail \-\-interface=eth1 \-\-interface=eth0.vlan100
982
983.TP
984\fB\-\-ip=address
985Assign IP addresses to the last network interface defined by a \-\-net option. A
986default gateway is assigned by default.
987.br
988
989.br
990Example:
991.br
992$ firejail \-\-net=eth0 \-\-ip=10.10.20.56 firefox
993
994.TP
995\fB\-\-ip=none
996No IP address and no default gateway are configured for the last interface
997defined by a \-\-net option. Use this option
998in case you intend to start an external DHCP client in the sandbox.
999.br
1000
1001.br
1002Example:
1003.br
1004$ firejail \-\-net=eth0 \-\-\ip=none
1005.br
1006
1007.br
1008If the corresponding interface doesn't have an IP address configured, this
1009option is enabled by default.
1010
1011.TP
1012\fB\-\-ip=dhcp
1013Acquire an IP address and default gateway for the last interface defined by a
1014\-\-net option, as well as set the DNS servers according to the DHCP response.
1015This option requires the ISC dhclient DHCP client to be installed and will start
1016it automatically inside the sandbox.
1017.br
1018
1019.br
1020Example:
1021.br
1022$ firejail \-\-net=br0 \-\-ip=dhcp
1023.br
1024
1025.br
1026This option should not be used in conjunction with the \-\-dns option if the
1027DHCP server is set to configure DNS servers for the clients, because the
1028manually specified DNS servers will be overwritten.
1029
1030.br
1031The DHCP client will NOT release the DHCP lease when the sandbox terminates.
1032If your DHCP server requires leases to be explicitly released, consider running
1033a DHCP client and releasing the lease manually in conjunction with the
1034\-\-net=none option.
1035
1036.TP
1037\fB\-\-ip6=address
1038Assign IPv6 addresses to the last network interface defined by a \-\-net option.
1039.br
1040
1041.br
1042Example:
1043.br
1044$ firejail \-\-net=eth0 \-\-ip6=2001:0db8:0:f101::1/64 firefox
1045
1046Note: you don't need this option if you obtain your ip6 address from router via SLAAC (your ip6 address and default route will be configured by kernel automatically).
1047
1048.TP
1049\fB\-\-ip6=dhcp
1050Acquire an IPv6 address and default gateway for the last interface defined by a
1051\-\-net option, as well as set the DNS servers according to the DHCP response.
1052This option requires the ISC dhclient DHCP client to be installed and will start
1053it automatically inside the sandbox.
1054.br
1055
1056.br
1057Example:
1058.br
1059$ firejail \-\-net=br0 \-\-ip6=dhcp
1060.br
1061
1062.br
1063This option should not be used in conjunction with the \-\-dns option if the
1064DHCP server is set to configure DNS servers for the clients, because the
1065manually specified DNS servers will be overwritten.
1066
1067.br
1068The DHCP client will NOT release the DHCP lease when the sandbox terminates.
1069If your DHCP server requires leases to be explicitly released, consider running
1070a DHCP client and releasing the lease manually.
1071
1072.TP
1073\fB\-\-iprange=address,address
1074Assign an IP address in the provided range to the last network interface defined by a \-\-net option. A
1075default gateway is assigned by default.
1076.br
1077
1078.br
1079Example:
1080.br
1081$ firejail \-\-net=eth0 \-\-\iprange=192.168.1.100,192.168.1.150
1082
1083.TP
1084\fB\-\-ipc-namespace
1085Enable a new IPC namespace if the sandbox was started as a regular user. IPC namespace is enabled by default
1086for sandboxes started as root.
1087.br
1088
1089.br
1090Example:
1091.br
1092$ firejail \-\-ipc-namespace firefox
1093#endif
1094.TP
1095\fB\-\-join=name|pid
1096Join the sandbox identified by name or by PID. By default a /bin/bash shell is started after joining the sandbox.
1097If a program is specified, the program is run in the sandbox. If \-\-join command is issued as a regular user,
1098all security filters are configured for the new process the same they are configured in the sandbox.
1099If \-\-join command is issued as root, the security filters and cpus configurations are not applied
1100to the process joining the sandbox.
1101.br
1102
1103.br
1104Example:
1105.br
1106$ firejail \-\-name=mygame \-\-caps.drop=all warzone2100 &
1107.br
1108$ firejail \-\-join=mygame
1109.br
1110
1111.br
1112Example:
1113.br
1114$ firejail \-\-list
1115.br
11163272:netblue::firejail \-\-private firefox
1117.br
1118$ firejail \-\-join=3272
1119
1120.TP
1121\fB\-\-join-filesystem=name|pid
1122Join the mount namespace of the sandbox identified by name or PID. By default a /bin/bash shell is started after joining the sandbox.
1123If a program is specified, the program is run in the sandbox. This command is available only to root user.
1124Security filters and cpus configurations are not applied to the process joining the sandbox.
1125#ifdef HAVE_NETWORK
1126.TP
1127\fB\-\-join-network=name|pid
1128Join the network namespace of the sandbox identified by name. By default a /bin/bash shell is started after joining the sandbox.
1129If a program is specified, the program is run in the sandbox. This command is available only to root user.
1130Security filters and cpus configurations are not applied to the process joining the sandbox. Example:
1131.br
1132
1133.br
1134# start firefox
1135.br
1136$ firejail --net=eth0 --name=browser firefox &
1137.br
1138
1139.br
1140# change netfilter configuration
1141.br
1142$ sudo firejail --join-network=browser bash -c "cat /etc/firejail/nolocal.net | /sbin/iptables-restore"
1143.br
1144
1145.br
1146# verify netfilter configuration
1147.br
1148$ sudo firejail --join-network=browser /sbin/iptables -vL
1149.br
1150
1151.br
1152# verify IP addresses
1153.br
1154$ sudo firejail --join-network=browser ip addr
1155.br
1156Switching to pid 1932, the first child process inside the sandbox
1157.br
11581: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default
1159.br
1160 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
1161.br
1162 inet 127.0.0.1/8 scope host lo
1163.br
1164 valid_lft forever preferred_lft forever
1165.br
1166 inet6 ::1/128 scope host
1167.br
1168 valid_lft forever preferred_lft forever
1169.br
11702: eth0-1931: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default
1171.br
1172 link/ether 76:58:14:42:78:e4 brd ff:ff:ff:ff:ff:ff
1173.br
1174 inet 192.168.1.158/24 brd 192.168.1.255 scope global eth0-1931
1175.br
1176 valid_lft forever preferred_lft forever
1177.br
1178 inet6 fe80::7458:14ff:fe42:78e4/64 scope link
1179.br
1180 valid_lft forever preferred_lft forever
1181#endif
1182.TP
1183\fB\-\-join-or-start=name
1184Join the sandbox identified by name or start a new one.
1185Same as "firejail --join=name" if sandbox with specified name exists, otherwise
1186same as "firejail --name=name ...".
1187See \fB\-\-name\fR for details.
1188.br
1189Note that in contrary to other join options there is respective profile option.
1190
1191.TP
1192\fB\-\-keep-config-pulse
1193Disable automatic ~/.config/pulse init, for complex setups such as remote
1194pulse servers or non-standard socket paths.
1195.br
1196
1197.br
1198Example:
1199.br
1200$ firejail \-\-keep-config-pulse firefox
1201
1202.TP
1203\fB\-\-keep-dev-shm
1204/dev/shm directory is untouched (even with --private-dev)
1205.br
1206
1207.br
1208Example:
1209.br
1210$ firejail --keep-dev-shm --private-dev
1211
1212.TP
1213\fB\-\-keep-fd=all
1214Inherit all open file descriptors to the sandbox. By default only file descriptors 0, 1 and 2 are inherited to the sandbox, and all other file descriptors are closed.
1215.br
1216
1217.br
1218Example:
1219.br
1220$ firejail --keep-fd=all
1221
1222.TP
1223\fB\-\-keep-fd=file_descriptor
1224Don't close specified open file descriptors. By default only file descriptors 0, 1 and 2 are inherited to the sandbox, and all other file descriptors are closed.
1225.br
1226
1227.br
1228Example:
1229.br
1230$ firejail --keep-fd=3,4,5
1231
1232.TP
1233\fB\-\-keep-shell-rc
1234By default, when using a private home directory, firejail copies files from the
1235system's user home template (/etc/skel) into it, which overrides attempts to
1236whitelist the original files (such as ~/.bashrc and ~/.zshrc).
1237This option disables this feature, and enables the user to whitelist the
1238original files.
1239
1240.TP
1241\fB\-\-keep-var-tmp
1242/var/tmp directory is untouched.
1243.br
1244
1245.br
1246Example:
1247.br
1248$ firejail --keep-var-tmp
1249
1250.TP
1251\fB\-\-list
1252List all sandboxes, see \fBMONITORING\fR section for more details.
1253.br
1254
1255.br
1256Example:
1257.br
1258$ firejail \-\-list
1259.br
12607015:netblue:browser:firejail firefox
1261#ifdef HAVE_NETWORK
1262.br
12637056:netblue:torrent:firejail \-\-net=eth0 transmission-gtk
1264#endif
1265#ifdef HAVE_USERNS
1266.br
12677064:netblue::firejail \-\-noroot xterm
1268.br
1269#endif
1270#ifdef HAVE_FILE_TRANSFER
1271.TP
1272\fB\-\-ls=name|pid dir_or_filename
1273List files in sandbox container, see \fBFILE TRANSFER\fR section for more details.
1274#endif
1275#ifdef HAVE_NETWORK
1276.TP
1277\fB\-\-mac=address
1278Assign MAC addresses to the last network interface defined by a \-\-net option. This option
1279is not supported for wireless interfaces.
1280.br
1281
1282.br
1283Example:
1284.br
1285$ firejail \-\-net=eth0 \-\-mac=00:11:22:33:44:55 firefox
1286#endif
1287.TP
1288\fB\-\-machine-id
1289Spoof id number in /etc/machine-id file - a new random id is generated inside the sandbox.
1290Note that this breaks audio support. Enable it when sound is not required.
1291.br
1292
1293.br
1294Example:
1295.br
1296$ firejail \-\-machine-id
1297
1298.TP
1299\fB\-\-mkdir=dirname
1300Create a directory in user home. Parent directories are created as needed.
1301.br
1302
1303.br
1304Example:
1305.br
1306$ firejail --mkdir=~/work/project
1307
1308.TP
1309\fB\-\-mkfile=filename
1310Create an empty file in user home.
1311.br
1312
1313.br
1314Example:
1315.br
1316$ firejail --mkfile=~/work/project/readme
1317
1318.TP
1319\fB\-\-memory-deny-write-execute
1320Install a seccomp filter to block attempts to create memory mappings
1321that are both writable and executable, to change mappings to be
1322executable, or to create executable shared memory. The filter examines
1323the arguments of mmap, mmap2, mprotect, pkey_mprotect, memfd_create
1324and shmat system calls and returns error EPERM to the process (or
1325kills it or log the attempt, see \-\-seccomp-error-action below) if necessary.
1326.br
1327
1328.br
1329Note: shmat is not implemented
1330as a system call on some platforms including i386, and it cannot be
1331handled by seccomp-bpf.
1332#ifdef HAVE_NETWORK
1333.TP
1334\fB\-\-mtu=number
1335Assign a MTU value to the last network interface defined by a \-\-net option.
1336.br
1337
1338.br
1339Example:
1340.br
1341$ firejail \-\-net=eth0 \-\-mtu=1492
1342#endif
1343.TP
1344\fB\-\-name=name
1345Set sandbox name. Several options, such as \-\-join and \-\-shutdown, can use
1346this name to identify a sandbox.
1347The name cannot contain only digits, as that is treated as a PID in the other
1348options, such as in \-\-join.
1349.br
1350For valid names, see the \fBNAME VALIDATION\fR section.
1351.br
1352
1353.br
1354In case the name supplied by the user is already in use by another sandbox, Firejail will assign a
1355new name as "name-PID", where PID is the process ID of the sandbox. This functionality
1356can be disabled at run time in /etc/firejail/firejail.config file, by setting "name-change" flag to "no".
1357.br
1358
1359.br
1360Example:
1361.br
1362$ firejail \-\-name=browser firefox &
1363.br
1364$ firejail \-\-name=browser \-\-private \
1365firefox \-\-no-remote &
1366.br
1367$ firejail --list
1368.br
13691198:netblue:browser:firejail --name=browser firefox
1370.br
13711312:netblue:browser-1312:firejail --name=browser --private firefox --no-remote
1372.br
1373#ifdef HAVE_NETWORK
1374.TP
1375\fB\-\-net=bridge_interface
1376Enable a new network namespace and connect it to this bridge interface.
1377Unless specified with option \-\-ip and \-\-defaultgw, an IP address and a default gateway will be assigned
1378automatically to the sandbox. The IP address is verified using ARP before assignment. The address
1379configured as default gateway is the bridge device IP address. Up to four \-\-net
1380options can be specified.
1381.br
1382
1383.br
1384Example:
1385.br
1386$ sudo brctl addbr br0
1387.br
1388$ sudo ifconfig br0 10.10.20.1/24
1389.br
1390$ sudo brctl addbr br1
1391.br
1392$ sudo ifconfig br1 10.10.30.1/24
1393.br
1394$ firejail \-\-net=br0 \-\-net=br1
1395
1396.TP
1397\fB\-\-net=ethernet_interface|wireless_interface
1398Enable a new network namespace and connect it
1399to this ethernet interface using the standard Linux macvlan|ipvlan
1400driver. Unless specified with option \-\-ip and \-\-defaultgw, an
1401IP address and a default gateway will be assigned automatically
1402to the sandbox. The IP address is verified using ARP before
1403assignment. The address configured as default gateway is the
1404default gateway of the host. Up to four \-\-net options can be specified.
1405Support for ipvlan driver was introduced in Linux kernel 3.19.
1406.br
1407
1408.br
1409Example:
1410.br
1411$ firejail \-\-net=eth0 \-\-ip=192.168.1.80 \-\-dns=8.8.8.8 firefox
1412.br
1413$ firejail \-\-net=wlan0 firefox
1414#endif
1415.TP
1416\fB\-\-net=none
1417Enable a new, unconnected network namespace. The only interface
1418available in the new namespace is a new loopback interface (lo).
1419Use this option to deny
1420network access to programs that don't really need network access.
1421.br
1422
1423.br
1424Example:
1425.br
1426$ firejail \-\-net=none vlc
1427.br
1428
1429.br
1430Note: \-\-net=none can crash the application on some platforms.
1431In these cases, it can be replaced with \-\-protocol=unix.
1432#ifdef HAVE_NETWORK
1433.TP
1434\fB\-\-net=tap_interface
1435Enable a new network namespace and connect it
1436to this ethernet tap interface using the standard Linux macvlan
1437driver. If the tap interface is not configured, the sandbox
1438will not try to configure the interface inside the sandbox.
1439Please use \-\-ip, \-\-netmask and \-\-defaultgw to specify the configuration.
1440.br
1441
1442.br
1443Example:
1444.br
1445$ firejail \-\-net=tap0 \-\-ip=10.10.20.80 \-\-netmask=255.255.255.0 \-\-defaultgw=10.10.20.1 firefox
1446
1447.TP
1448\fB\-\-net.print=name|pid
1449If a new network namespace is enabled, print network interface configuration for the sandbox specified by name or PID. Example:
1450.br
1451
1452.br
1453$ firejail --net.print=browser
1454.br
1455Switching to pid 1853, the first child process inside the sandbox
1456.br
1457Interface MAC IP Mask Status
1458.br
1459lo 127.0.0.1 255.0.0.0 UP
1460.br
1461eth0-1852 5e:fb:8e:27:29:26 192.168.1.186 255.255.255.0 UP
1462.br
1463
1464.TP
1465\fB\-\-netfilter
1466Enable a default firewall if a new network namespace is created inside the sandbox.
1467This option has no effect for sandboxes using the system network namespace.
1468.br
1469
1470.br
1471The default firewall is optimized for regular desktop applications. No incoming
1472connections are accepted:
1473.br
1474
1475.br
1476*filter
1477.br
1478:INPUT DROP [0:0]
1479.br
1480:FORWARD DROP [0:0]
1481.br
1482:OUTPUT ACCEPT [0:0]
1483.br
1484\-A INPUT \-i lo \-j ACCEPT
1485.br
1486\-A INPUT \-m state \-\-state RELATED,ESTABLISHED \-j ACCEPT
1487.br
1488# allow ping
1489.br
1490\-A INPUT \-p icmp \-\-icmp-type destination-unreachable \-j ACCEPT
1491.br
1492\-A INPUT \-p icmp \-\-icmp-type time-exceeded \-j ACCEPT
1493.br
1494\-A INPUT \-p icmp \-\-icmp-type echo-request \-j ACCEPT
1495.br
1496# drop STUN (WebRTC) requests
1497.br
1498-A OUTPUT -p udp --dport 3478 -j DROP
1499.br
1500-A OUTPUT -p udp --dport 3479 -j DROP
1501.br
1502-A OUTPUT -p tcp --dport 3478 -j DROP
1503.br
1504-A OUTPUT -p tcp --dport 3479 -j DROP
1505.br
1506COMMIT
1507.br
1508
1509.br
1510Example:
1511.br
1512$ firejail \-\-net=eth0 \-\-netfilter firefox
1513.TP
1514\fB\-\-netfilter=filename
1515Enable the firewall specified by filename if a new network namespace is created inside the sandbox.
1516This option has no effect for sandboxes using the system network namespace.
1517.br
1518
1519.br
1520Please use the regular iptables-save/iptables-restore format for the filter file. The following
1521examples are available in /etc/firejail directory:
1522.br
1523
1524.br
1525.B webserver.net
1526is a webserver firewall that allows access only to TCP ports 80 and 443.
1527Example:
1528.br
1529
1530.br
1531$ firejail --netfilter=/etc/firejail/webserver.net --net=eth0 \\
1532.br
1533/etc/init.d/apache2 start
1534.br
1535
1536.br
1537.B nolocal.net/nolocal6.net
1538is a desktop client firewall that disable access to local network. Example:
1539.br
1540
1541.br
1542$ firejail --netfilter=/etc/firejail/nolocal.net \\
1543.br
1544--net=eth0 firefox
1545
1546.TP
1547\fB\-\-netfilter=filename,arg1,arg2,arg3 ...
1548This is the template version of the previous command. $ARG1, $ARG2, $ARG3 ... in the firewall script
1549are replaced with arg1, arg2, arg3 ... passed on the command line. Up to 16 arguments are supported.
1550Example:
1551.br
1552
1553.br
1554$ firejail --net=eth0 --ip=192.168.1.105 \\
1555.br
1556--netfilter=/etc/firejail/tcpserver.net,5001 server-program
1557.br
1558
1559.TP
1560\fB\-\-netfilter.print=name|pid
1561Print the firewall installed in the sandbox specified by name or PID. Example:
1562.br
1563
1564.br
1565$ firejail --name=browser --net=eth0 --netfilter firefox &
1566.br
1567$ firejail --netfilter.print=browser
1568
1569.TP
1570\fB\-\-netfilter6=filename
1571Enable the IPv6 firewall specified by filename if a new network namespace is created inside the sandbox.
1572This option has no effect for sandboxes using the system network namespace.
1573Please use the regular iptables-save/iptables-restore format for the filter file.
1574
1575.TP
1576\fB\-\-netfilter6.print=name|pid
1577Print the IPv6 firewall installed in the sandbox specified by name or PID. Example:
1578.br
1579
1580.br
1581$ firejail --name=browser --net=eth0 --netfilter firefox &
1582.br
1583$ firejail --netfilter6.print=browser
1584
1585.TP
1586\fB\-\-netlock
1587Several type of programs (email clients, multiplayer games etc.) talk to a very small
1588number of IP addresses. But the best example is tor browser. It only talks to a guard node,
1589and there are two or three more on standby in case the main one fails.
1590During startup, the browser contacts all of them, after that it keeps talking to the main
1591one... for weeks!
1592
1593Use the network locking feature to build and deploy a custom network firewall in your sandbox.
1594The firewall allows only the traffic to the IP addresses detected during the program
1595startup. Traffic to any other address is quietly dropped. By default the network monitoring
1596time is one minute.
1597
1598A network namespace (\-\-net=eth0) is required for this feature to work. Example:
1599.br
1600
1601.br
1602$ firejail --net=eth0 --netlock \\
1603.br
1604--private=~/tor-browser_en-US ./start-tor-browser.desktop
1605.br
1606
1607.br
1608
1609.TP
1610\fB\-\-netmask=address
1611Use this option when you want to assign an IP address in a new namespace and
1612the parent interface specified by --net is not configured. An IP address and
1613a default gateway address also have to be added. By default the new namespace
1614interface comes without IP address and default gateway configured. Example:
1615.br
1616
1617.br
1618$ sudo /sbin/brctl addbr br0
1619.br
1620$ sudo /sbin/ifconfig br0 up
1621.br
1622$ firejail --ip=10.10.20.67 --netmask=255.255.255.0 --defaultgw=10.10.20.1
1623
1624.TP
1625\fB\-\-netns=name
1626Run the program in a named, persistent network namespace. These can
1627be created and configured using "ip netns".
1628
1629.TP
1630\fB\-\-netstats
1631Monitor network namespace statistics, see \fBMONITORING\fR section for more details.
1632.br
1633
1634.br
1635Example:
1636.br
1637
1638.br
1639$ firejail \-\-netstats
1640.br
1641PID User RX(KB/s) TX(KB/s) Command
1642.br
16431294 netblue 53.355 1.473 firejail \-\-net=eth0 firefox
1644.br
16457383 netblue 9.045 0.112 firejail \-\-net=eth0 transmission
1646.TP
1647\fB\-\-nettrace[=name|pid]
1648Monitor received TCP. UDP, and ICMP traffic. The sandbox can be specified by name or pid. Only networked sandboxes
1649created with \-\-net are supported. This option is only available when running the sandbox as root.
1650.br
1651
1652.br
1653Without a name/pid, Firejail will monitor the main system network namespace.
1654.br
1655
1656.br
1657Example:
1658.br
1659$ sudo firejail --nettrace
1660.br
1661 95 KB/s geoip 457, IP database 4436
1662.br
1663 52 KB/s *********** 64.222.84.207:443 United States
1664.br
1665 33 KB/s ******* 89.147.74.105:63930 Hungary
1666.br
1667 0 B/s 45.90.28.0:443 NextDNS
1668.br
1669 0 B/s 94.70.122.176:52309(UDP) Greece
1670.br
1671 339 B/s 104.26.7.35:443 Cloudflare
1672.br
1673
1674.br
1675If /usr/bin/geoiplookup is installed (geoip-bin package in Debian),
1676the country the traffic originates from is added to the trace.
1677We also use the static IP map in /usr/lib/firejail/static-ip-map
1678to print the domain names for some of the more common websites and cloud platforms.
1679No external services are contacted for reverse IP lookup.
1680#endif
1681.TP
1682\fB\-\-nice=value
1683Set nice value for all processes running inside the sandbox.
1684Only root may specify a negative value.
1685.br
1686
1687.br
1688Example:
1689.br
1690$ firejail --nice=2 firefox
1691
1692.TP
1693\fB\-\-no3d
1694Disable 3D hardware acceleration.
1695.br
1696
1697.br
1698Example:
1699.br
1700$ firejail --no3d firefox
1701
1702.TP
1703\fB\-\-noautopulse \fR(deprecated)
1704See --keep-config-pulse.
1705
1706.TP
1707\fB\-\-noblacklist=dirname_or_filename
1708Disable blacklist for this directory or file.
1709.br
1710
1711.br
1712Example:
1713.br
1714$ firejail
1715.br
1716$ nc dict.org 2628
1717.br
1718bash: /bin/nc: Permission denied
1719.br
1720$ exit
1721.br
1722
1723.br
1724$ firejail --noblacklist=/bin/nc
1725.br
1726$ nc dict.org 2628
1727.br
1728220 pan.alephnull.com dictd 1.12.1/rf on Linux 3.14-1-amd64
1729.br
1730.TP
1731\fB\-\-nodbus \fR(deprecated)
1732#ifdef HAVE_DBUSPROXY
1733Disable D-Bus access (both system and session buses). Equivalent to --dbus-system=none --dbus-user=none.
1734.br
1735
1736.br
1737Example:
1738.br
1739$ firejail \-\-nodbus \-\-net=none
1740#endif
1741.TP
1742\fB\-\-nodvd
1743Disable DVD and audio CD devices.
1744.br
1745
1746.br
1747Example:
1748.br
1749$ firejail \-\-nodvd
1750.TP
1751\fB\-\-noinput
1752Disable input devices.
1753.br
1754
1755.br
1756Example:
1757.br
1758$ firejail \-\-noinput
1759.TP
1760\fB\-\-noexec=dirname_or_filename
1761Remount directory or file noexec, nodev and nosuid. File globbing is supported, see \fBFILE GLOBBING\fR section for more details.
1762.br
1763
1764.br
1765Example:
1766.br
1767$ firejail \-\-noexec=/tmp
1768.br
1769
1770.br
1771/etc and /var are noexec by default if the sandbox was started as a regular user.
1772
1773.TP
1774\fB\-\-nogroups
1775Disable supplementary groups. Without this option, supplementary groups are enabled for the user starting the
1776sandbox. For root user supplementary groups are always disabled.
1777.br
1778
1779.br
1780Note: By default all regular user groups are removed with the exception of the current user. This can be changed
1781using \-\-allusers command option.
1782.br
1783
1784.br
1785Example:
1786.br
1787$ id
1788.br
1789uid=1000(netblue) gid=1000(netblue) groups=1000(netblue),24(cdrom),25(floppy),27(sudo),29(audio)
1790.br
1791$ firejail \-\-nogroups
1792.br
1793Parent pid 8704, child pid 8705
1794.br
1795Child process initialized
1796.br
1797$ id
1798.br
1799uid=1000(netblue) gid=1000(netblue) groups=1000(netblue)
1800.br
1801$
1802
1803.TP
1804\fB\-\-nonewprivs
1805Sets the NO_NEW_PRIVS prctl. This ensures that child processes
1806cannot acquire new privileges using execve(2); in particular,
1807this means that calling a suid binary (or one with file capabilities)
1808does not result in an increase of privilege. This option
1809is enabled by default if seccomp filter is activated.
1810
1811.TP
1812\fB\-\-noprinters
1813Disable printers.
1814
1815.TP
1816\fB\-\-noprofile
1817Do not use a security profile.
1818.br
1819
1820.br
1821Example:
1822.br
1823$ firejail
1824.br
1825Reading profile /etc/firejail/default.profile
1826.br
1827Parent pid 8553, child pid 8554
1828.br
1829Child process initialized
1830.br
1831[...]
1832.br
1833
1834.br
1835$ firejail \-\-noprofile
1836.br
1837Parent pid 8553, child pid 8554
1838.br
1839Child process initialized
1840.br
1841[...]
1842#ifdef HAVE_USERNS
1843.TP
1844\fB\-\-noroot
1845Install a user namespace with a single user - the current user.
1846root user does not exist in the new namespace. This option
1847requires a Linux kernel version 3.8 or newer. The option
1848is not supported for \-\-chroot and \-\-overlay configurations,
1849or for sandboxes started as root.
1850.br
1851
1852.br
1853Example:
1854.br
1855$ firejail \-\-noroot
1856.br
1857Parent pid 8553, child pid 8554
1858.br
1859Child process initialized
1860.br
1861$ ping google.com
1862.br
1863ping: icmp open socket: Operation not permitted
1864.br
1865$
1866#endif
1867.TP
1868\fB\-\-nosound
1869Disable sound system.
1870.br
1871
1872.br
1873Example:
1874.br
1875$ firejail \-\-nosound firefox
1876
1877.TP
1878\fB\-\-notv
1879Disable DVB (Digital Video Broadcasting) TV devices.
1880.br
1881
1882.br
1883Example:
1884.br
1885$ firejail \-\-notv vlc
1886
1887.TP
1888\fB\-\-nou2f
1889Disable U2F devices.
1890.br
1891
1892.br
1893Example:
1894.br
1895$ firejail \-\-nou2f
1896
1897.TP
1898\fB\-\-novideo
1899Disable video devices.
1900.br
1901
1902.TP
1903\fB\-\-nowhitelist=dirname_or_filename
1904Disable whitelist for this directory or file.
1905
1906.TP
1907\fB\-\-oom=value
1908Configure kernel's OutOfMemory-killer score for this sandbox. The acceptable score values are between 0 and 1000
1909for regular users, and -1000 to 1000 for root. For more information on OOM kernel feature see \fBman choom\fR.
1910.br
1911
1912.br
1913Example:
1914.br
1915$ firejail \-\-oom=300 firefox
1916
1917#ifdef HAVE_OUTPUT
1918.TP
1919\fB\-\-output=logfile
1920stdout logging and log rotation. Copy stdout to logfile, and keep the size of the file under 500KB using log
1921rotation. Five files with prefixes .1 to .5 are used in rotation.
1922.br
1923
1924.br
1925Example:
1926.br
1927$ firejail \-\-output=sandboxlog /bin/bash
1928.br
1929[...]
1930.br
1931$ ls -l sandboxlog*
1932.br
1933-rw-r--r-- 1 netblue netblue 333890 Jun 2 07:48 sandboxlog
1934.br
1935-rw-r--r-- 1 netblue netblue 511488 Jun 2 07:48 sandboxlog.1
1936.br
1937-rw-r--r-- 1 netblue netblue 511488 Jun 2 07:48 sandboxlog.2
1938.br
1939-rw-r--r-- 1 netblue netblue 511488 Jun 2 07:48 sandboxlog.3
1940.br
1941-rw-r--r-- 1 netblue netblue 511488 Jun 2 07:48 sandboxlog.4
1942.br
1943-rw-r--r-- 1 netblue netblue 511488 Jun 2 07:48 sandboxlog.5
1944
1945.TP
1946\fB\-\-output-stderr=logfile
1947Similar to \-\-output, but stderr is also stored.
1948#endif
1949
1950#ifdef HAVE_OVERLAYFS
1951.TP
1952\fB\-\-overlay
1953Mount a filesystem overlay on top of the current filesystem. Unlike the regular filesystem container,
1954the system directories are mounted read-write. All filesystem modifications go into the overlay.
1955Directories /run, /tmp and /dev are not covered by the overlay. The overlay is stored in $HOME/.firejail/<PID> directory.
1956If the sandbox is started as a regular user, nonewprivs and a default capabilities filter are enabled.
1957.br
1958
1959.br
1960OverlayFS support is required in Linux kernel for this option to work.
1961OverlayFS was officially introduced in Linux kernel version 3.18.
1962This option is not available on Grsecurity systems.
1963.br
1964
1965.br
1966Example:
1967.br
1968$ firejail \-\-overlay firefox
1969
1970.TP
1971\fB\-\-overlay-clean
1972Clean all overlays stored in $HOME/.firejail directory.
1973.br
1974
1975.br
1976Example:
1977.br
1978$ firejail \-\-overlay-clean
1979
1980.TP
1981\fB\-\-overlay-named=name
1982Mount a filesystem overlay on top of the current filesystem. Unlike the regular filesystem container,
1983the system directories are mounted read-write. All filesystem modifications go into the overlay.
1984Directories /run, /tmp and /dev are not covered by the overlay. The overlay is stored in $HOME/.firejail/<NAME> directory.
1985The created overlay can be reused between multiple sessions.
1986If the sandbox is started as a regular user, nonewprivs and a default capabilities filter are enabled.
1987.br
1988
1989.br
1990OverlayFS support is required in Linux kernel for this option to work.
1991OverlayFS was officially introduced in Linux kernel version 3.18.
1992This option is not available on Grsecurity systems.
1993.br
1994
1995.br
1996Example:
1997.br
1998$ firejail \-\-overlay-named=jail1 firefox
1999
2000.TP
2001\fB\-\-overlay-tmpfs
2002Mount a filesystem overlay on top of the current filesystem. All filesystem modifications
2003are discarded when the sandbox is closed. Directories /run, /tmp and /dev are not covered by the overlay.
2004If the sandbox is started as a regular user, nonewprivs and a default capabilities filter are enabled.
2005.br
2006
2007.br
2008OverlayFS support is required in Linux kernel for this option to work.
2009OverlayFS was officially introduced in Linux kernel version 3.18.
2010This option is not available on Grsecurity systems.
2011.br
2012
2013.br
2014Example:
2015.br
2016$ firejail \-\-overlay-tmpfs firefox
2017#endif
2018.TP
2019\fB\-\-private
2020Mount new /root and /home/user directories in temporary
2021filesystems. All modifications are discarded when the sandbox is
2022closed.
2023.br
2024
2025.br
2026Example:
2027.br
2028$ firejail \-\-private firefox
2029
2030.TP
2031\fB\-\-private=directory
2032Use directory as user home.
2033--private and --private=directory cannot be used together.
2034.br
2035
2036.br
2037Example:
2038.br
2039$ firejail \-\-private=/home/netblue/firefox-home firefox
2040.br
2041
2042.br
2043Bug: Even with this enabled, some commands (such as mkdir, mkfile and
2044private-cache) will still operate on the original home directory.
2045Workaround: Disable the incompatible commands, such as by using "ignore mkdir"
2046and "ignore mkfile".
2047For details, see
2048.UR https://github.com/netblue30/firejail/issues/903
2049#903
2050.UE
2051
2052.TP
2053\fB\-\-private-bin=file,file
2054Build a new /bin in a temporary filesystem, and copy the programs in the list.
2055The files in the list must be expressed as relative to the /bin,
2056/sbin, /usr/bin, /usr/sbin, or /usr/local/bin directories.
2057If no listed files are found, /bin directory will be empty.
2058The same directory is also bind-mounted over /sbin, /usr/bin, /usr/sbin and /usr/local/bin.
2059All modifications are discarded when the sandbox is closed.
2060Multiple private-bin commands are allowed and they accumulate.
2061File globbing is supported, see \fBFILE GLOBBING\fR section for more details.
2062.br
2063
2064.br
2065Example:
2066.br
2067$ firejail \-\-private-bin=bash,sed,ls,cat
2068.br
2069Parent pid 20841, child pid 20842
2070.br
2071Child process initialized
2072.br
2073$ ls /bin
2074.br
2075bash cat ls sed
2076
2077.TP
2078\fB\-\-private-cache
2079Mount an empty temporary filesystem on top of the .cache directory in user home. All
2080modifications are discarded when the sandbox is closed.
2081.br
2082
2083.br
2084Example:
2085.br
2086$ firejail \-\-private-cache openbox
2087
2088.TP
2089\fB\-\-private-cwd
2090Set working directory inside jail to the home directory, and failing that, the root directory.
2091Does not impact working directory of profile include paths.
2092.br
2093
2094.br
2095Example:
2096.br
2097$ pwd
2098.br
2099/tmp
2100.br
2101$ firejail \-\-private-cwd
2102.br
2103$ pwd
2104.br
2105/home/user
2106.br
2107
2108.TP
2109\fB\-\-private-cwd=directory
2110Set working directory inside the jail.
2111Full directory path is required. Symbolic links are not allowed.
2112Does not impact working directory of profile include paths.
2113.br
2114
2115.br
2116Example:
2117.br
2118$ pwd
2119.br
2120/tmp
2121.br
2122$ firejail \-\-private-cwd=/opt
2123.br
2124$ pwd
2125.br
2126/opt
2127.br
2128
2129.TP
2130\fB\-\-private-dev
2131Create a new /dev directory. Only disc, dri, dvb, hidraw, null, full, zero, tty, pts, ptmx, random, snd, urandom, video, log, shm and usb devices are available.
2132Use the options --no3d, --nodvd, --nosound, --notv, --nou2f and --novideo for additional restrictions.
2133.br
2134
2135.br
2136Example:
2137.br
2138$ firejail \-\-private-dev
2139.br
2140Parent pid 9887, child pid 9888
2141.br
2142Child process initialized
2143.br
2144$ ls /dev
2145.br
2146cdrom cdrw dri dvd dvdrw full log null ptmx pts random shm snd sr0 tty urandom zero
2147.br
2148$
2149.TP
2150\fB\-\-private-etc, \-\-private-etc=file,directory,@group
2151The files installed by \-\-private-etc are copies of the original system files from /etc directory.
2152By default, the command brings in a skeleton of files and directories used by most console tools:
2153
2154$ firejail --private-etc dig debian.org
2155
2156For X11/GTK/QT/Gnome/KDE programs add @x11 group as a parameter. Example:
2157
2158$ firejail --private-etc=@x11,gcrypt,python* gimp
2159
2160gcrypt and /etc/python* directories are not part of the generic @x11 group.
2161File globbing is supported.
2162
2163For games, add @games group:
2164
2165$ firejail --private-etc=@games,@x11 warzone2100
2166
2167Sound and networking files are included automatically, unless \-\-nosound or \-\-net=none are specified.
2168Files for encrypted TLS/SSL protocol are in @tls-ca group.
2169
2170$ firejail --private-etc=@tls-ca,wgetrc wget https://debian.org
2171
2172
2173Note: The easiest way to extract the list of /etc files accessed by your program is using strace utility:
2174
2175$ strace /usr/bin/transmission-qt 2>&1 | grep open | grep etc
2176#ifdef HAVE_PRIVATE_HOME
2177.TP
2178\fB\-\-private-home=file,directory
2179Build a new user home in a temporary
2180filesystem, and copy the files and directories in the list in the
2181new home.
2182The files and directories in the list must be expressed as relative to
2183the current user's home directory.
2184All modifications are discarded when the sandbox is
2185closed.
2186.br
2187
2188.br
2189Example:
2190.br
2191$ firejail \-\-private-home=.mozilla firefox
2192#endif
2193#ifdef HAVE_PRIVATE_LIB
2194.TP
2195\fB\-\-private-lib=file,directory
2196This feature is currently under heavy development. Only amd64 platforms are supported at this moment.
2197The files and directories in the list must be expressed as relative to
2198the /lib directory.
2199The idea is to build a new /lib in a temporary filesystem,
2200with only the library files necessary to run the application.
2201It could be as simple as:
2202.br
2203
2204.br
2205$ firejail --private-lib galculator
2206.br
2207
2208.br
2209but it gets complicated really fast:
2210.br
2211
2212.br
2213$ firejail --private-lib=x86_64-linux-gnu/xed,x86_64-linux-gnu/gdk-pixbuf-2.0,libenchant.so.1,librsvg-2.so.2 xed
2214.br
2215
2216.br
2217The feature is integrated with \-\-private-bin:
2218.br
2219
2220.br
2221$ firejail --private-lib --private-bin=bash,ls,ps
2222.br
2223$ ls /lib
2224.br
2225ld-linux-x86-64.so.2 libgpg-error.so.0 libprocps.so.6 libsystemd.so.0
2226.br
2227libc.so.6 liblz4.so.1 libpthread.so.0 libtinfo.so.5
2228.br
2229libdl.so.2 liblzma.so.5 librt.so.1 x86_64-linux-gnu
2230.br
2231libgcrypt.so.20 libpcre.so.3 libselinux.so.1
2232.br
2233$ ps
2234.br
2235 PID TTY TIME CMD
2236.br
2237 1 pts/0 00:00:00 firejail
2238.br
2239 45 pts/0 00:00:00 bash
2240.br
2241 48 pts/0 00:00:00 ps
2242.br
2243$
2244.br
2245
2246.br
2247Note: Support for this command is controlled in firejail.config with the
2248\fBprivate-lib\fR option.
2249#endif
2250.TP
2251\fB\-\-private-opt=file,directory
2252Build a new /opt in a temporary
2253filesystem, and copy the files and directories in the list.
2254The files and directories in the list must be expressed as relative to
2255the /opt directory, and must not contain the / character
2256(e.g., /opt/foo must be expressed as foo, but /opt/foo/bar --
2257expressed as foo/bar -- is disallowed).
2258If no listed file is found, /opt directory will be empty.
2259All modifications are discarded when the sandbox is closed.
2260.br
2261
2262.br
2263Example:
2264.br
2265$ firejail --private-opt=firefox /opt/firefox/firefox
2266
2267.TP
2268\fB\-\-private-srv=file,directory
2269Build a new /srv in a temporary
2270filesystem, and copy the files and directories in the list.
2271The files and directories in the list must be expressed as relative to
2272the /srv directory, and must not contain the / character
2273(e.g., /srv/foo must be expressed as foo, but /srv/foo/bar --
2274expressed as srv/bar -- is disallowed).
2275If no listed file is found, /srv directory will be empty.
2276All modifications are discarded when the sandbox is closed.
2277.br
2278
2279.br
2280Example:
2281.br
2282# firejail --private-srv=www /etc/init.d/apache2 start
2283
2284.TP
2285\fB\-\-private-tmp
2286Mount an empty temporary filesystem on top of /tmp directory whitelisting X11 and PulseAudio sockets.
2287.br
2288
2289.br
2290Example:
2291.br
2292$ firejail \-\-private-tmp
2293.br
2294$ ls -al /tmp
2295.br
2296drwxrwxrwt 4 nobody nogroup 80 Apr 30 11:46 .
2297.br
2298drwxr-xr-x 30 nobody nogroup 4096 Apr 26 22:18 ..
2299.br
2300drwx------ 2 nobody nogroup 4096 Apr 30 10:52 pulse-PKdhtXMmr18n
2301.br
2302drwxrwxrwt 2 nobody nogroup 4096 Apr 30 10:52 .X11-unix
2303.br
2304
2305.TP
2306\fB\-\-profile=filename_or_profilename
2307Load a custom security profile from filename. For filename use an absolute path or a path relative to the current path.
2308For more information, see \fBSECURITY PROFILES\fR section below.
2309.br
2310
2311.br
2312Example:
2313.br
2314$ firejail \-\-profile=myprofile
2315
2316.TP
2317\fB\-\-profile.print=name|pid
2318Print the name of the profile file for the sandbox identified by name or or PID.
2319.br
2320
2321.br
2322Example:
2323.br
2324$ firejail \-\-profile.print=browser
2325.br
2326/etc/firejail/firefox.profile
2327.br
2328.TP
2329\fB\-\-protocol=protocol,protocol,protocol
2330Enable protocol filter. The filter is based on seccomp and checks the first argument to socket system call.
2331Recognized values: unix, inet, inet6, netlink, packet, and bluetooth. This option is not supported for i386 architecture.
2332Multiple protocol commands are allowed and they accumulate.
2333.br
2334
2335.br
2336Example:
2337.br
2338$ firejail \-\-protocol=unix,inet,inet6 firefox
2339.TP
2340\fB\-\-protocol.print=name|pid
2341Print the protocol filter for the sandbox identified by name or PID.
2342.br
2343
2344.br
2345Example:
2346.br
2347$ firejail \-\-name=mybrowser firefox &
2348.br
2349$ firejail \-\-protocol.print=mybrowser
2350.br
2351unix,inet,inet6,netlink
2352.br
2353
2354.br
2355Example:
2356.br
2357$ firejail \-\-list
2358.br
23593272:netblue::firejail \-\-private firefox
2360.br
2361$ firejail \-\-protocol.print=3272
2362.br
2363unix,inet,inet6,netlink
2364#ifdef HAVE_FILE_TRANSFER
2365.TP
2366\fB\-\-put=name|pid src-filename dest-filename
2367Put a file in sandbox container, see \fBFILE TRANSFER\fR section for more details.
2368#endif
2369.TP
2370\fB\-\-quiet
2371Turn off Firejail's output.
2372.br
2373
2374.br
2375The same effect can be obtained by setting an environment variable FIREJAIL_QUIET to yes.
2376.TP
2377\fB\-\-read-only=dirname_or_filename
2378Set directory or file read-only. File globbing is supported, see \fBFILE GLOBBING\fR section for more details.
2379.br
2380
2381.br
2382Example:
2383.br
2384$ firejail \-\-read-only=~/.mozilla firefox
2385.br
2386.TP
2387\fB\-\-read-write=dirname_or_filename
2388Set directory or file read-write. Only files or directories belonging to the current user are allowed for
2389this operation. File globbing is supported, see \fBFILE GLOBBING\fR section for more details.
2390Example:
2391.br
2392
2393.br
2394$ mkdir ~/test
2395.br
2396$ touch ~/test/a
2397.br
2398$ firejail --read-only=~/test --read-write=~/test/a
2399
2400
2401.TP
2402\fB\-\-restrict-namespaces
2403Install a seccomp filter that blocks attempts to create new cgroup, ipc, net, mount, pid, time, user or uts namespaces.
2404.br
2405
2406.br
2407Example:
2408.br
2409$ firejail \-\-restrict-namespaces
2410
2411.TP
2412\fB\-\-restrict-namespaces=cgroup,ipc,net,mnt,pid,time,user,uts
2413Install a seccomp filter that blocks attempts to create any of the specified namespaces. The filter examines
2414the arguments of clone, unshare and setns system calls and returns error EPERM to the process
2415(or kills it or logs the attempt, see \-\-seccomp-error-action below) if necessary. Note that the filter is not
2416able to examine the arguments of clone3 system calls, and always responds to these calls with error ENOSYS.
2417.br
2418
2419.br
2420Example:
2421.br
2422$ firejail \-\-restrict-namespaces=user,net
2423
2424.TP
2425\fB\-\-rlimit-as=number
2426Set the maximum size of the process's virtual memory (address space) in bytes.
2427Use k(ilobyte), m(egabyte) or g(igabyte) for size suffix (base 1024).
2428
2429.TP
2430\fB\-\-rlimit-cpu=number
2431Set the maximum limit, in seconds, for the amount of CPU time each
2432sandboxed process can consume. When the limit is reached, the processes are killed.
2433
2434The CPU limit is a limit on CPU seconds rather than elapsed time. CPU seconds is basically how many seconds
2435the CPU has been in use and does not necessarily directly relate to the elapsed time. Linux kernel keeps
2436track of CPU seconds for each process independently.
2437
2438.TP
2439\fB\-\-rlimit-fsize=number
2440Set the maximum file size that can be created by a process.
2441Use k(ilobyte), m(egabyte) or g(igabyte) for size suffix (base 1024).
2442.TP
2443\fB\-\-rlimit-nofile=number
2444Set the maximum number of files that can be opened by a process.
2445.TP
2446\fB\-\-rlimit-nproc=number
2447Set the maximum number of processes that can be created for the real user ID of the calling process.
2448.TP
2449\fB\-\-rlimit-sigpending=number
2450Set the maximum number of pending signals for a process.
2451
2452.TP
2453\fB\-\-rmenv=name
2454Remove environment variable in the new sandbox.
2455.br
2456
2457.br
2458Example:
2459.br
2460$ firejail \-\-rmenv=DBUS_SESSION_BUS_ADDRESS
2461#ifdef HAVE_NETWORK
2462.TP
2463\fB\-\-scan
2464ARP-scan all the networks from inside a network namespace.
2465This makes it possible to detect macvlan kernel device drivers running on the current host.
2466.br
2467
2468.br
2469Example:
2470.br
2471$ firejail \-\-net=eth0 \-\-scan
2472#endif
2473.TP
2474\fB\-\-seccomp
2475Enable seccomp filter and blacklist the syscalls in the default list,
2476which is @default-nodebuggers unless \-\-allow-debuggers is specified,
2477then it is @default.
2478
2479.br
2480To help creating useful seccomp filters more easily, the following
2481system call groups are defined: @aio, @basic-io, @chown, @clock,
2482@cpu-emulation, @debug, @default, @default-nodebuggers, @default-keep,
2483@file-system, @io-event, @ipc, @keyring, @memlock, @module, @mount,
2484@network-io, @obsolete, @privileged, @process, @raw-io, @reboot,
2485@resources, @setuid, @swap, @sync, @system-service and @timer.
2486More information about groups can be found in /usr/share/doc/firejail/syscalls.txt
2487.br
2488
2489.br
2490The default list can be customized, see \-\-seccomp= for a description.
2491It can be customized also globally in /etc/firejail/firejail.config file.
2492.br
2493
2494.br
2495System architecture is strictly imposed only if flag
2496\-\-seccomp.block-secondary is used. The filter is applied at run time
2497only if the correct architecture was detected. For the case of I386
2498and AMD64 both 32-bit and 64-bit filters are installed.
2499.br
2500
2501.br
2502Firejail will print seccomp violations to the audit log if the kernel was compiled with audit support (CONFIG_AUDIT flag).
2503.br
2504
2505.br
2506Example:
2507.br
2508$ firejail \-\-seccomp
2509
2510
2511.TP
2512\fB\-\-seccomp=syscall,@group,!syscall2
2513Enable seccomp filter, blacklist the default list and the syscalls or syscall groups
2514specified by the command, but don't blacklist "syscall2". On a 64 bit
2515architecture, an additional filter for 32 bit system calls can be
2516installed with \-\-seccomp.32.
2517.br
2518
2519.br
2520Example:
2521.br
2522$ firejail \-\-seccomp=utime,utimensat,utimes firefox
2523.br
2524$ firejail \-\-seccomp=@clock,mkdir,unlinkat transmission-gtk
2525.br
2526$ firejail '\-\-seccomp=@ipc,!pipe,!pipe2' audacious
2527.br
2528
2529.br
2530Syscalls can be specified by their number if prefix $ is added,
2531so for example $165 would be equal to mount on i386.
2532.br
2533
2534.br
2535Instead of dropping the syscall by returning EPERM, another error
2536number can be returned using \fBsyscall:errno\fR syntax. This can be
2537also changed globally with \-\-seccomp-error-action or
2538in /etc/firejail/firejail.config file. The process can also be killed
2539by using \fBsyscall:kill\fR syntax, or the attempt may be logged with
2540\fBsyscall:log\fR.
2541.br
2542
2543.br
2544Example:
2545.br
2546$ firejail \-\-seccomp=unlinkat:ENOENT,utimensat,utimes
2547.br
2548Parent pid 10662, child pid 10663
2549.br
2550Child process initialized
2551.br
2552$ touch testfile
2553.br
2554$ ls testfile
2555.br
2556testfile
2557.br
2558$ rm testfile
2559.br
2560rm: cannot remove `testfile': No such file or directory
2561.br
2562
2563.br
2564If the blocked system calls would also block Firejail from operating,
2565they are handled by adding a preloaded library which performs seccomp
2566system calls later. However, this is incompatible with 32 bit seccomp
2567filters.
2568.br
2569
2570.br
2571Example:
2572.br
2573$ firejail \-\-noprofile \-\-seccomp=execve sh
2574.br
2575Parent pid 32751, child pid 32752
2576.br
2577Post-exec seccomp protector enabled
2578.br
2579list in: execve, check list: @default-keep prelist: (null), postlist: execve
2580.br
2581Child process initialized in 46.44 ms
2582.br
2583$ ls
2584.br
2585Operation not permitted
2586
2587.TP
2588\fB\-\-seccomp.block-secondary
2589Enable seccomp filter and filter system call architectures so that
2590only the native architecture is allowed. For example, on amd64, i386
2591and x32 system calls are blocked as well as changing the execution
2592domain with personality(2) system call.
2593.br
2594
2595.TP
2596\fB\-\-seccomp.drop=syscall,@group
2597Enable seccomp filter, and blacklist the syscalls or the syscall
2598groups specified by the command. On a 64 bit architecture, an
2599additional filter for 32 bit system calls can be installed with
2600\-\-seccomp.32.drop.
2601.br
2602
2603.br
2604Example:
2605.br
2606$ firejail \-\-seccomp.drop=utime,utimensat,utimes,@clock
2607.br
2608
2609.br
2610Instead of dropping the syscall by returning EPERM, another error
2611number can be returned using \fBsyscall:errno\fR syntax. This can be
2612also changed globally with \-\-seccomp-error-action or
2613in /etc/firejail/firejail.config file. The process can also be killed
2614by using \fBsyscall:kill\fR syntax, or the attempt may be logged with
2615\fBsyscall:log\fR.
2616.br
2617
2618.br
2619Example:
2620.br
2621$ firejail \-\-seccomp.drop=unlinkat:ENOENT,utimensat,utimes
2622.br
2623Parent pid 10662, child pid 10663
2624.br
2625Child process initialized
2626.br
2627$ touch testfile
2628.br
2629$ ls testfile
2630.br
2631testfile
2632.br
2633$ rm testfile
2634.br
2635rm: cannot remove `testfile': No such file or directory
2636.br
2637
2638.TP
2639\fB\-\-seccomp.keep=syscall,@group,!syscall2
2640Enable seccomp filter, blacklist all syscall not listed and "syscall2".
2641The system calls needed by Firejail (group @default-keep: prctl, execve, execveat)
2642are handled with the preload library. On a 64 bit architecture, an
2643additional filter for 32 bit system calls can be installed with
2644\-\-seccomp.32.keep.
2645.br
2646
2647.br
2648Example:
2649.br
2650$ firejail \-\-seccomp.keep=poll,select,[...] transmission-gtk
2651
2652.TP
2653\fB\-\-seccomp.print=name|pid
2654Print the seccomp filter for the sandbox identified by name or PID.
2655.br
2656
2657.br
2658Example:
2659.br
2660$ firejail \-\-name=browser firefox &
2661.br
2662$ firejail --seccomp.print=browser
2663.br
2664 line OP JT JF K
2665.br
2666=================================
2667.br
2668 0000: 20 00 00 00000004 ld data.architecture
2669.br
2670 0001: 15 01 00 c000003e jeq ARCH_64 0003 (false 0002)
2671.br
2672 0002: 06 00 00 7fff0000 ret ALLOW
2673.br
2674 0003: 20 00 00 00000000 ld data.syscall-number
2675.br
2676 0004: 35 01 00 40000000 jge X32_ABI true:0006 (false 0005)
2677.br
2678 0005: 35 01 00 00000000 jge read 0007 (false 0006)
2679.br
2680 0006: 06 00 00 00050001 ret ERRNO(1)
2681.br
2682 0007: 15 41 00 0000009a jeq modify_ldt 0049 (false 0008)
2683.br
2684 0008: 15 40 00 000000d4 jeq lookup_dcookie 0049 (false 0009)
2685.br
2686 0009: 15 3f 00 0000012a jeq perf_event_open 0049 (false 000a)
2687.br
2688 000a: 15 3e 00 00000137 jeq process_vm_writev 0049 (false 000b)
2689.br
2690 000b: 15 3d 00 0000009c jeq _sysctl 0049 (false 000c)
2691.br
2692 000c: 15 3c 00 000000b7 jeq afs_syscall 0049 (false 000d)
2693.br
2694 000d: 15 3b 00 000000ae jeq create_module 0049 (false 000e)
2695.br
2696 000e: 15 3a 00 000000b1 jeq get_kernel_syms 0049 (false 000f)
2697.br
2698 000f: 15 39 00 000000b5 jeq getpmsg 0049 (false 0010)
2699.br
2700 0010: 15 38 00 000000b6 jeq putpmsg 0049 (false 0011)
2701.br
2702 0011: 15 37 00 000000b2 jeq query_module 0049 (false 0012)
2703.br
2704 0012: 15 36 00 000000b9 jeq security 0049 (false 0013)
2705.br
2706 0013: 15 35 00 0000008b jeq sysfs 0049 (false 0014)
2707.br
2708 0014: 15 34 00 000000b8 jeq tuxcall 0049 (false 0015)
2709.br
2710 0015: 15 33 00 00000086 jeq uselib 0049 (false 0016)
2711.br
2712 0016: 15 32 00 00000088 jeq ustat 0049 (false 0017)
2713.br
2714 0017: 15 31 00 000000ec jeq vserver 0049 (false 0018)
2715.br
2716 0018: 15 30 00 0000009f jeq adjtimex 0049 (false 0019)
2717.br
2718 0019: 15 2f 00 00000131 jeq clock_adjtime 0049 (false 001a)
2719.br
2720 001a: 15 2e 00 000000e3 jeq clock_settime 0049 (false 001b)
2721.br
2722 001b: 15 2d 00 000000a4 jeq settimeofday 0049 (false 001c)
2723.br
2724 001c: 15 2c 00 000000b0 jeq delete_module 0049 (false 001d)
2725.br
2726 001d: 15 2b 00 00000139 jeq finit_module 0049 (false 001e)
2727.br
2728 001e: 15 2a 00 000000af jeq init_module 0049 (false 001f)
2729.br
2730 001f: 15 29 00 000000ad jeq ioperm 0049 (false 0020)
2731.br
2732 0020: 15 28 00 000000ac jeq iopl 0049 (false 0021)
2733.br
2734 0021: 15 27 00 000000f6 jeq kexec_load 0049 (false 0022)
2735.br
2736 0022: 15 26 00 00000140 jeq kexec_file_load 0049 (false 0023)
2737.br
2738 0023: 15 25 00 000000a9 jeq reboot 0049 (false 0024)
2739.br
2740 0024: 15 24 00 000000a7 jeq swapon 0049 (false 0025)
2741.br
2742 0025: 15 23 00 000000a8 jeq swapoff 0049 (false 0026)
2743.br
2744 0026: 15 22 00 000000a3 jeq acct 0049 (false 0027)
2745.br
2746 0027: 15 21 00 00000141 jeq bpf 0049 (false 0028)
2747.br
2748 0028: 15 20 00 000000a1 jeq chroot 0049 (false 0029)
2749.br
2750 0029: 15 1f 00 000000a5 jeq mount 0049 (false 002a)
2751.br
2752 002a: 15 1e 00 000000b4 jeq nfsservctl 0049 (false 002b)
2753.br
2754 002b: 15 1d 00 0000009b jeq pivot_root 0049 (false 002c)
2755.br
2756 002c: 15 1c 00 000000ab jeq setdomainname 0049 (false 002d)
2757.br
2758 002d: 15 1b 00 000000aa jeq sethostname 0049 (false 002e)
2759.br
2760 002e: 15 1a 00 000000a6 jeq umount2 0049 (false 002f)
2761.br
2762 002f: 15 19 00 00000099 jeq vhangup 0049 (false 0030)
2763.br
2764 0030: 15 18 00 000000ee jeq set_mempolicy 0049 (false 0031)
2765.br
2766 0031: 15 17 00 00000100 jeq migrate_pages 0049 (false 0032)
2767.br
2768 0032: 15 16 00 00000117 jeq move_pages 0049 (false 0033)
2769.br
2770 0033: 15 15 00 000000ed jeq mbind 0049 (false 0034)
2771.br
2772 0034: 15 14 00 00000130 jeq open_by_handle_at 0049 (false 0035)
2773.br
2774 0035: 15 13 00 0000012f jeq name_to_handle_at 0049 (false 0036)
2775.br
2776 0036: 15 12 00 000000fb jeq ioprio_set 0049 (false 0037)
2777.br
2778 0037: 15 11 00 00000067 jeq syslog 0049 (false 0038)
2779.br
2780 0038: 15 10 00 0000012c jeq fanotify_init 0049 (false 0039)
2781.br
2782 0039: 15 0f 00 00000138 jeq kcmp 0049 (false 003a)
2783.br
2784 003a: 15 0e 00 000000f8 jeq add_key 0049 (false 003b)
2785.br
2786 003b: 15 0d 00 000000f9 jeq request_key 0049 (false 003c)
2787.br
2788 003c: 15 0c 00 000000fa jeq keyctl 0049 (false 003d)
2789.br
2790 003d: 15 0b 00 000000ce jeq io_setup 0049 (false 003e)
2791.br
2792 003e: 15 0a 00 000000cf jeq io_destroy 0049 (false 003f)
2793.br
2794 003f: 15 09 00 000000d0 jeq io_getevents 0049 (false 0040)
2795.br
2796 0040: 15 08 00 000000d1 jeq io_submit 0049 (false 0041)
2797.br
2798 0041: 15 07 00 000000d2 jeq io_cancel 0049 (false 0042)
2799.br
2800 0042: 15 06 00 000000d8 jeq remap_file_pages 0049 (false 0043)
2801.br
2802 0043: 15 05 00 00000116 jeq vmsplice 0049 (false 0044)
2803.br
2804 0044: 15 04 00 00000087 jeq personality 0049 (false 0045)
2805.br
2806 0045: 15 03 00 00000143 jeq userfaultfd 0049 (false 0046)
2807.br
2808 0046: 15 02 00 00000065 jeq ptrace 0049 (false 0047)
2809.br
2810 0047: 15 01 00 00000136 jeq process_vm_readv 0049 (false 0048)
2811.br
2812 0048: 06 00 00 7fff0000 ret ALLOW
2813.br
2814 0049: 06 00 01 00000000 ret KILL
2815.br
2816$
2817
2818.TP
2819\fB\-\-seccomp-error-action= kill | ERRNO | log
2820By default, if a seccomp filter blocks a system call, the process gets
2821EPERM as the error. With \-\-seccomp-error-action=error, another error
2822number can be returned, for example ENOSYS or EACCES. The process can
2823also be killed (like in versions <0.9.63 of Firejail) by using
2824\-\-seccomp-error-action=kill syntax, or the attempt may be logged
2825with \-\-seccomp-error-action=log. Not killing the process weakens
2826Firejail slightly when trying to contain intrusion, but it may also
2827allow tighter filters if the only alternative is to allow a system
2828call.
2829.br
2830
2831.TP
2832\fB\-\-shutdown=name|pid
2833Shutdown the sandbox identified by name or PID.
2834.br
2835
2836.br
2837Example:
2838.br
2839$ firejail \-\-name=mygame \-\-caps.drop=all warzone2100 &
2840.br
2841$ firejail \-\-shutdown=mygame
2842.br
2843
2844.br
2845Example:
2846.br
2847$ firejail \-\-list
2848.br
28493272:netblue::firejail \-\-private firefox
2850.br
2851$ firejail \-\-shutdown=3272
2852
2853#ifdef HAVE_NETWORK
2854.TP
2855\fB\-\-snitrace[=name|pid]
2856Monitor Server Name Indication (TLS/SNI). The sandbox can be specified by name or pid. Only networked sandboxes
2857created with \-\-net are supported. This option is only available when running the sandbox as root.
2858.br
2859
2860.br
2861Without a name/pid, Firejail will monitor the main system network namespace.
2862.br
2863
2864.br
2865Example:
2866.br
2867$ sudo firejail --snitrace
2868.br
286907:49:51 23.185.0.3 linux.com
2870.br
287107:49:51 23.185.0.3 www.linux.com
2872.br
287307:50:05 192.0.73.2 secure.gravatar.com
2874.br
287507:52:35 172.67.68.93 www.howtoforge.com
2876.br
287707:52:37 13.225.103.59 sf.ezoiccdn.com
2878.br
287907:52:42 142.250.176.3 www.gstatic.com
2880.br
288107:53:03 173.236.250.32 www.linuxlinks.com
2882.br
288307:53:05 192.0.77.37 c0.wp.com
2884.br
288507:53:08 192.0.78.32 jetpack.wordpress.com
2886.br
288707:53:09 192.0.77.32 s0.wp.com
2888.br
288907:53:09 192.0.77.2 i0.wp.com
2890.br
289107:53:10 192.0.77.2 i0.wp.com
2892.br
289307:53:11 192.0.73.2 1.gravatar.com
2894.br
2895#endif
2896
2897.TP
2898\fB\-\-tab
2899Enable shell tab completion in sandboxes using private or whitelisted home directories.
2900.br
2901
2902.br
2903$ firejail \-\-private --tab
2904.TP
2905\fB\-\-timeout=hh:mm:ss
2906Kill the sandbox automatically after the time has elapsed. The time is specified in hours/minutes/seconds format.
2907.br
2908
2909.br
2910$ firejail \-\-timeout=01:30:00 firefox
2911.TP
2912\fB\-\-tmpfs=dirname
2913Mount a writable tmpfs filesystem on directory dirname. Directories outside user home or not owned by the user are not allowed. Sandboxes running as root are exempt from these restrictions. File globbing is supported, see \fBFILE GLOBBING\fR section for more details.
2914.br
2915
2916.br
2917Example:
2918.br
2919$ firejail \-\-tmpfs=~/.local/share
2920.TP
2921\fB\-\-top
2922Monitor the most CPU-intensive sandboxes, see \fBMONITORING\fR section for more details.
2923.br
2924
2925.br
2926Example:
2927.br
2928$ firejail \-\-top
2929.TP
2930\fB\-\-trace[=filename]
2931Trace open, access and connect system calls. If filename is specified, log
2932trace output to filename, otherwise log to console.
2933.br
2934
2935.br
2936Example:
2937.br
2938$ firejail \-\-trace wget -q www.debian.org
2939.br
2940Reading profile /etc/firejail/wget.profile
2941.br
29423:wget:fopen64 /etc/wgetrc:0x5c8e8ce6c0
2943.br
29443:wget:fopen /etc/hosts:0x5c8e8cfb70
2945.br
29463:wget:socket AF_INET SOCK_DGRAM IPPROTO_IP:3
2947.br
29483:wget:connect 3 8.8.8.8 port 53:0
2949.br
29503:wget:socket AF_INET SOCK_STREAM IPPROTO_IP:3
2951.br
29523:wget:connect 3 130.89.148.14 port 80:0
2953.br
29543:wget:fopen64 index.html:0x5c8e8d1a60
2955.br
2956
2957.br
2958parent is shutting down, bye...
2959.TP
2960\fB\-\-tracelog
2961This option enables auditing blacklisted files and directories. A message
2962is sent to syslog in case the file or the directory is accessed.
2963.br
2964
2965.br
2966Example:
2967.br
2968$ firejail --tracelog firefox
2969.br
2970
2971.br
2972Sample messages:
2973.br
2974$ sudo tail -f /var/log/syslog
2975.br
2976[...]
2977.br
2978Dec 3 11:43:25 debian firejail[70]: blacklist violation - sandbox 26370, exe firefox, syscall open64, path /etc/shadow
2979.br
2980Dec 3 11:46:17 debian firejail[70]: blacklist violation - sandbox 26370, exe firefox, syscall opendir, path /boot
2981.br
2982[...]
2983.br
2984
2985.br
2986Note: Support for this command is controlled in firejail.config with the
2987\fBtracelog\fR option.
2988.TP
2989\fB\-\-tree
2990Print a tree of all sandboxed processes, see \fBMONITORING\fR section for more details.
2991.br
2992
2993.br
2994Example:
2995.br
2996$ firejail \-\-tree
2997.br
299811903:netblue:firejail iceweasel
2999.br
3000 11904:netblue:iceweasel
3001.br
3002 11957:netblue:/usr/lib/iceweasel/plugin-container
3003#ifdef HAVE_NETWORK
3004.br
300511969:netblue:firejail \-\-net=eth0 transmission-gtk
3006#endif
3007.br
3008 11970:netblue:transmission-gtk
3009
3010#ifdef HAVE_FIRETUNNEL
3011.TP
3012\fB\-\-tunnel[=devname]
3013Connect the sandbox to a network overlay/VPN tunnel created by firetunnel utility. This options
3014tries first the client side of the tunnel. If this fails, it tries the server side. If multiple tunnels are active,
3015please specify the tunnel device using \-\-tunnel=devname.
3016.br
3017
3018.br
3019The available tunnel devices are listed in /etc/firetunnel directory, one file for each device.
3020The files are regular firejail profile files containing the network configuration,
3021and are created and managed by firetunnel utility.
3022By default ftc is the client-side device and fts is the server-side device. For more information
3023please see man 1 firetunnel.
3024.br
3025
3026.br
3027Example:
3028.br
3029$ firejail --tunnel firefox
3030.br
3031#endif
3032.TP
3033\fB\-\-version
3034Print program version/compile time support and exit.
3035.br
3036
3037.br
3038Example:
3039.br
3040$ firejail \-\-version
3041.br
3042firejail version 0.9.27
3043
3044Compile time support:
3045 - AppArmor support is enabled
3046 - AppImage support is enabled
3047 - chroot support is enabled
3048 - file and directory whitelisting support is enabled
3049 - file transfer support is enabled
3050 - firetunnel support is enabled
3051 - networking support is enabled
3052 - overlayfs support is enabled
3053 - private-home support is enabled
3054 - seccomp-bpf support is enabled
3055 - user namespace support is enabled
3056 - X11 sandboxing support is enabled
3057.br
3058#ifdef HAVE_NETWORK
3059.TP
3060\fB\-\-veth-name=name
3061Use this name for the interface connected to the bridge for --net=bridge_interface commands,
3062instead of the default one.
3063.br
3064
3065.br
3066Example:
3067.br
3068$ firejail \-\-net=br0 --veth-name=if0
3069#endif
3070.TP
3071\fB\-\-whitelist=dirname_or_filename
3072Whitelist directory or file. A temporary file system is mounted on the top directory, and the
3073whitelisted files are mount-binded inside. Modifications to whitelisted files are persistent,
3074everything else is discarded when the sandbox is closed. The top directory can be
3075all directories in / (except /proc and /sys), /sys/module, /run/user/$UID, $HOME and
3076all directories in /usr.
3077.br
3078
3079.br
3080Symbolic link handling: Whitelisting a path that is a symbolic link will also
3081whitelist the path that it points to.
3082For example, if ~/foo is whitelisted and it points to ~/bar, then ~/bar will
3083also be whitelisted.
3084Restrictions: With the exception of the user home directory, both the link and
3085the real file should be in the same top directory.
3086For symbolic links in the user home directory, both the link and the real file
3087should be owned by the user.
3088.br
3089
3090.br
3091File globbing is supported, see \fBFILE GLOBBING\fR section for more details.
3092.br
3093
3094.br
3095Example:
3096.br
3097$ firejail \-\-noprofile \-\-whitelist=~/.mozilla
3098.br
3099$ firejail \-\-whitelist=/tmp/.X11-unix \-\-whitelist=/dev/null
3100.br
3101$ firejail "\-\-whitelist=/home/username/My Virtual Machines"
3102.br
3103$ firejail \-\-whitelist=~/work* \-\-whitelist=/var/backups*
3104
3105.TP
3106\fB\-\-writable-etc
3107Mount /etc directory read-write.
3108.br
3109
3110.br
3111Example:
3112.br
3113$ sudo firejail --writable-etc
3114
3115.TP
3116\fB\-\-writable-run-user
3117Disable the default blacklisting of /run/user/$UID/systemd and /run/user/$UID/gnupg.
3118.br
3119
3120.br
3121Example:
3122.br
3123$ sudo firejail --writable-run-user
3124
3125.TP
3126\fB\-\-writable-var
3127Mount /var directory read-write.
3128.br
3129
3130.br
3131Example:
3132.br
3133$ sudo firejail --writable-var
3134
3135.TP
3136\fB\-\-writable-var-log
3137Use the real /var/log directory, not a clone. By default, a tmpfs is mounted on top of /var/log
3138directory, and a skeleton filesystem is created based on the original /var/log.
3139.br
3140
3141.br
3142Example:
3143.br
3144$ sudo firejail --writable-var-log
3145
3146#ifdef HAVE_X11
3147.TP
3148\fB\-\-x11
3149Sandbox the application using Xpra, Xephyr, Xvfb or Xorg security extension.
3150The sandbox will prevent screenshot and keylogger applications started inside the sandbox from accessing
3151clients running outside the sandbox.
3152Firejail will try Xpra first, and if Xpra is not installed on the system, it will try to find Xephyr.
3153If all fails, Firejail will not attempt to use Xvfb or X11 security extension.
3154.br
3155
3156.br
3157Xpra, Xephyr and Xvfb modes require a network namespace to be instantiated in order to disable
3158X11 abstract Unix socket. If this is not possible, the user can disable the abstract socket
3159by adding "-nolisten local" on Xorg command line at system level.
3160.br
3161
3162.br
3163Example:
3164.br
3165$ firejail \-\-x11 --net=eth0 firefox
3166
3167.TP
3168\fB\-\-x11=none
3169Blacklist /tmp/.X11-unix directory, ${HOME}/.Xauthority and the file specified in ${XAUTHORITY} environment variable.
3170Remove DISPLAY and XAUTHORITY environment variables.
3171Stop with error message if X11 abstract socket will be accessible in jail.
3172
3173.TP
3174\fB\-\-x11=xephyr
3175Start Xephyr and attach the sandbox to this server.
3176Xephyr is a display server implementing the X11 display server protocol.
3177A network namespace needs to be instantiated in order to deny access to X11 abstract Unix domain socket.
3178.br
3179
3180.br
3181Xephyr runs in a window just like any other X11 application. The default window size is 800x600.
3182This can be modified in /etc/firejail/firejail.config file.
3183.br
3184
3185.br
3186The recommended way to use this feature is to run a window manager inside the sandbox.
3187A security profile for OpenBox is provided.
3188.br
3189
3190.br
3191Xephyr is developed by Xorg project. On Debian platforms it is installed with the command \fBsudo apt-get install xserver-xephyr\fR.
3192This feature is not available when running as root.
3193.br
3194
3195.br
3196Example:
3197.br
3198$ firejail \-\-x11=xephyr --net=eth0 openbox
3199
3200.TP
3201\fB\-\-x11=xorg
3202Sandbox the application using the untrusted mode implemented by X11 security extension.
3203The extension is available in Xorg package
3204and it is installed by default on most Linux distributions. It provides support for a simple trusted/untrusted
3205connection model. Untrusted clients are restricted in certain ways to prevent them from reading window
3206contents of other clients, stealing input events, etc.
3207
3208The untrusted mode has several limitations. A lot of regular programs assume they are a trusted X11 clients
3209and will crash or lock up when run in untrusted mode. Chromium browser and xterm are two examples.
3210Firefox and transmission-gtk seem to be working fine.
3211A network namespace is not required for this option.
3212.br
3213
3214.br
3215Example:
3216.br
3217$ firejail \-\-x11=xorg firefox
3218
3219.TP
3220\fB\-\-x11=xpra
3221Start Xpra (https://xpra.org) and attach the sandbox to this server.
3222Xpra is a persistent remote display server and client for forwarding X11 applications and desktop screens.
3223A network namespace needs to be instantiated in order to deny access to X11 abstract Unix domain socket.
3224.br
3225
3226.br
3227On Debian platforms Xpra is installed with the command \fBsudo apt-get install xpra\fR.
3228This feature is not available when running as root.
3229.br
3230
3231.br
3232Example:
3233.br
3234$ firejail \-\-x11=xpra --net=eth0 firefox
3235
3236
3237.TP
3238\fB\-\-x11=xvfb
3239Start Xvfb X11 server and attach the sandbox to this server.
3240Xvfb, short for X virtual framebuffer, performs all graphical operations in memory
3241without showing any screen output. Xvfb is mainly used for remote access and software
3242testing on headless servers.
3243.br
3244
3245.br
3246On Debian platforms Xvfb is installed with the command \fBsudo apt-get install xvfb\fR.
3247This feature is not available when running as root.
3248.br
3249
3250.br
3251Example: remote VNC access
3252.br
3253
3254.br
3255On the server we start a sandbox using Xvfb and openbox
3256window manager. The default size of Xvfb screen is 800x600 - it can be changed
3257in /etc/firejail/firejail.config (xvfb-screen). Some sort of networking (--net) is required
3258in order to isolate the abstract sockets used by other X servers.
3259.br
3260
3261.br
3262$ firejail --net=none --x11=xvfb openbox
3263.br
3264
3265.br
3266*** Attaching to Xvfb display 792 ***
3267.br
3268
3269.br
3270Reading profile /etc/firejail/openbox.profile
3271.br
3272Reading profile /etc/firejail/disable-common.inc
3273.br
3274Reading profile /etc/firejail/disable-common.local
3275.br
3276Parent pid 5400, child pid 5401
3277.br
3278
3279.br
3280On the server we also start a VNC server and attach it to the display handled by our
3281Xvfb server (792).
3282.br
3283
3284.br
3285$ x11vnc -display :792
3286.br
3287
3288.br
3289On the client machine we start a VNC viewer and use it to connect to our server:
3290.br
3291
3292.br
3293$ vncviewer
3294.br
3295
3296.TP
3297\fB\-\-xephyr-screen=WIDTHxHEIGHT
3298Set screen size for --x11=xephyr. The setting will overwrite the default set in /etc/firejail/firejail.config
3299for the current sandbox. Run xrandr to get a list of supported resolutions on your computer.
3300.br
3301
3302.br
3303Example:
3304.br
3305$ firejail --net=eth0 --x11=xephyr --xephyr-screen=640x480 firefox
3306.br
3307#endif
3308.\" Note: Keep this in sync with invalid_name() in src/firejail/util.c.
3309.SH NAME VALIDATION
3310For simplicity, the same name validation is used for multiple options.
3311Rules:
3312.PP
3313The name must be 1-253 characters long.
3314The name can only contain ASCII letters, digits and the special characters
3315"-._" (that is, the name cannot contain spaces or control characters).
3316The name cannot contain only digits.
3317The first and last characters must be an ASCII letter or digit and the name
3318may contain special characters in the middle.
3319#ifdef HAVE_APPARMOR
3320.SH APPARMOR
3321.TP
3322AppArmor support is disabled by default at compile time. Use --enable-apparmor configuration option to enable it:
3323.br
3324
3325.br
3326$ ./configure --prefix=/usr --enable-apparmor
3327.TP
3328During software install, a generic AppArmor profile file, firejail-default, is placed in /etc/apparmor.d directory. The local customizations must be placed in /etc/apparmor.d/local/firejail-local. The profile needs to be loaded into the kernel by reloading apparmor.service, rebooting the system or running the following command as root:
3329.br
3330
3331.br
3332# apparmor_parser -r /etc/apparmor.d/firejail-default
3333.TP
3334The installed profile is supplemental for main firejail functions and among other things does the following:
3335.br
3336
3337.br
3338- Disable ptrace. With ptrace it is possible to inspect and hijack running programs. Usually this is needed only for debugging. You should have no problems running Chromium or Firefox. This feature is available only on Ubuntu kernels.
3339.br
3340
3341.br
3342- Whitelist write access to several files under /run, /proc and /sys.
3343.br
3344
3345.br
3346- Allow running programs only from well-known system paths, such as /bin, /sbin, /usr/bin etc. Those paths are available as read-only. Running programs and scripts from user home or other directories writable by the user is not allowed.
3347.br
3348
3349.br
3350- Prevent using non-standard network sockets. Only unix, inet, inet6, netlink, raw and packet are allowed.
3351.br
3352
3353.br
3354- Deny access to known sensitive paths like .snapshots.
3355
3356.TP
3357To enable AppArmor confinement on top of your current Firejail security features, pass \fB\-\-apparmor\fR flag to Firejail command line. You can also include \fBapparmor\fR command in a Firejail profile file. Example:
3358.br
3359
3360.br
3361$ firejail --apparmor firefox
3362#endif
3363
3364.SH DESKTOP INTEGRATION
3365A symbolic link to /usr/bin/firejail under the name of a program, will start the program in Firejail sandbox.
3366The symbolic link should be placed in the first $PATH position. On most systems, a good place
3367is /usr/local/bin directory. Example:
3368.PP
3369.RS
3370.br
3371
3372.br
3373Make a firefox symlink to /usr/bin/firejail:
3374.br
3375
3376.br
3377$ sudo ln -s /usr/bin/firejail /usr/local/bin/firefox
3378.br
3379
3380.br
3381Verify $PATH
3382.br
3383
3384.br
3385$ which -a firefox
3386.br
3387/usr/local/bin/firefox
3388.br
3389/usr/bin/firefox
3390.br
3391
3392.br
3393Starting firefox in this moment, automatically invokes “firejail firefox”.
3394.RE
3395.br
3396
3397.br
3398This works for clicking on desktop environment icons, menus etc. Use "firejail --tree"
3399to verify the program is sandboxed.
3400.PP
3401.RS
3402.br
3403
3404.br
3405.br
3406$ firejail --tree
3407.br
34081189:netblue:firejail firefox
3409.br
3410 1190:netblue:firejail firefox
3411.br
3412 1220:netblue:/bin/sh -c "/usr/lib/firefox/firefox"
3413.br
3414 1221:netblue:/usr/lib/firefox/firefox
3415.RE
3416
3417We provide a tool that automates all this integration, please see \&\flfirecfg\fR\|(1) for more details.
3418
3419.SH EXAMPLES
3420.TP
3421\f\firejail
3422Sandbox a regular shell session.
3423.TP
3424\f\firejail firefox
3425Start Mozilla Firefox.
3426.TP
3427\f\firejail \-\-debug firefox
3428Debug Firefox sandbox.
3429.TP
3430\f\firejail \-\-private firefox
3431Start Firefox with a new, empty home directory.
3432.TP
3433\f\firejail --net=none vlc
3434Start VLC in an unconnected network namespace.
3435#ifdef HAVE_NETWORK
3436.TP
3437\f\firejail \-\-net=eth0 firefox
3438Start Firefox in a new network namespace. An IP address is
3439assigned automatically.
3440.TP
3441\f\firejail \-\-net=br0 \-\-ip=10.10.20.5 \-\-net=br1 \-\-net=br2
3442Start a shell session in a new network namespace and connect it
3443to br0, br1, and br2 host bridge devices. IP addresses are assigned
3444automatically for the interfaces connected to br1 and b2
3445#endif
3446.TP
3447\f\firejail \-\-list
3448List all sandboxed processes.
3449
3450.SH FILE GLOBBING
3451.TP
3452Globbing is the operation that expands a wildcard pattern into the
3453list of pathnames matching the pattern. This pattern is matched at
3454firejail \fBstart\fR, and is NOT UPDATED at runtime. \fBFiles matching
3455a blacklist, but created after firejail start will be accessible within
3456the jail.\fR Matching is defined by:
3457.br
3458
3459.br
3460- '?' matches any character
3461.br
3462- '*' matches any string
3463.br
3464- '[' denotes a range of characters
3465.br
3466.TP
3467The globbing feature is implemented using glibc glob command. For
3468more information on the wildcard syntax see man 7 glob.
3469.br
3470
3471.br
3472.TP
3473The following command line options are supported: \-\-blacklist,
3474\-\-private-bin, \-\-noexec, \-\-read-only, \-\-read-write,
3475\-\-tmpfs, and \-\-whitelist.
3476.br
3477
3478.br
3479.TP
3480Examples:
3481.br
3482
3483.br
3484$ firejail --private-bin=sh,bash,python*
3485.br
3486$ firejail --blacklist=~/dir[1234]
3487.br
3488$ firejail --read-only=~/dir[1-4]
3489.br
3490
3491#ifdef HAVE_FILE_TRANSFER
3492.SH FILE TRANSFER
3493These features allow the user to inspect the filesystem container of an existing sandbox
3494and transfer files between the container and the host filesystem.
3495
3496.TP
3497\fB\-\-cat=name|pid filename
3498Write content of a container file to standard out. The container is specified by name or PID.
3499If standard out is a terminal, all ASCII control characters except new line and horizontal tab
3500are replaced.
3501
3502.TP
3503\fB\-\-get=name|pid filename
3504Retrieve the container file and store it on the host in the current working directory.
3505The container is specified by name or PID.
3506
3507.TP
3508\fB\-\-ls=name|pid dir_or_filename
3509List container files. The container is specified by name or PID.
3510
3511.TP
3512\fB\-\-put=name|pid src-filename dest-filename
3513Put src-filename in sandbox container.
3514The container is specified by name or PID.
3515
3516.TP
3517Examples:
3518.br
3519
3520.br
3521$ firejail \-\-name=mybrowser --private firefox
3522.br
3523
3524.br
3525$ firejail \-\-ls=mybrowser ~/Downloads
3526.br
3527drwxr-xr-x netblue netblue 4096 .
3528.br
3529drwxr-xr-x netblue netblue 4096 ..
3530.br
3531-rw-r--r-- netblue netblue 7847 x11-x305.png
3532.br
3533-rw-r--r-- netblue netblue 6800 x11-x642.png
3534.br
3535-rw-r--r-- netblue netblue 34139 xpra-clipboard.png
3536.br
3537
3538.br
3539$ firejail \-\-get=mybrowser ~/Downloads/xpra-clipboard.png
3540.br
3541
3542.br
3543$ firejail \-\-put=mybrowser xpra-clipboard.png ~/Downloads/xpra-clipboard.png
3544.br
3545
3546.br
3547$ firejail \-\-cat=mybrowser ~/.bashrc
3548.br
3549#endif
3550
3551#ifdef HAVE_IDS
3552.SH INTRUSION DETECTION SYSTEM (IDS)
3553The host-based intrusion detection system tracks down and audits user and system file modifications.
3554The feature is configured using /etc/firejail/ids.config file, the checksums are stored in /var/lib/firejail/USERNAME.ids,
3555where USERNAME is the name of the current user. We use BLAKE2 cryptographic function for hashing.
3556
3557As a regular user, initialize the database:
3558.br
3559
3560.br
3561$ firejail --ids-init
3562.br
3563Opening config file /etc/firejail/ids.config
3564.br
3565Loading config file /etc/firejail/ids.config
3566.br
3567Opening config file /etc/firejail/ids.config.local
3568.br
3569500 1000 1500 2000
3570.br
35712466 files scanned
3572.br
3573IDS database initialized
3574.br
3575
3576.br
3577The default configuration targets several system executables in directories such as /bin, /sbin, /usr/bin, /usr/sbin, and several critical config files in user home directory
3578such as ~/.bashrc, ~/.xinitrc, and ~/.config/autostart. Several system config files in /etc directory are also hashed.
3579.br
3580
3581.br
3582Run --ids-check to audit the system:
3583.br
3584
3585.br
3586$ firejail --ids-check
3587.br
3588Opening config file /etc/firejail/ids.config
3589.br
3590Loading config file /etc/firejail/ids.config
3591.br
3592Opening config file /etc/firejail/ids.config.local
3593.br
3594500 1000 1500
3595.br
3596Warning: modified /home/netblue/.bashrc
3597.br
35982000
3599.br
36002466 files scanned: modified 1, permissions 0, new 0, removed 0
3601.br
3602
3603.br
3604The program will print the files that have been modified since the database was created, or the files with different access permissions.
3605New files and deleted files are also flagged.
3606
3607Currently while scanning the file system, symbolic links are not followed, and files the user doesn't have read access to are silently dropped.
3608The program can also be run as root (sudo firejail --ids-init/--ids-check).
3609#endif
3610
3611.SH MONITORING
3612Option \-\-list prints a list of all sandboxes. The format
3613for each process entry is as follows:
3614
3615 PID:USER:Sandbox Name:Command
3616
3617Option \-\-tree prints the tree of processes running in the sandbox. The format
3618for each process entry is as follows:
3619
3620 PID:USER:Sandbox Name:Command
3621
3622Option \-\-top is similar to the UNIX top command, however it applies only to
3623sandboxes.
3624
3625Option \-\-netstats prints network statistics for active sandboxes installing new network namespaces.
3626
3627Listed below are the available fields (columns) in alphabetical
3628order for \-\-top and \-\-netstats options:
3629
3630.TP
3631Command
3632Command used to start the sandbox.
3633.TP
3634CPU%
3635CPU usage, the sandbox share of the elapsed CPU time since the
3636last screen update
3637.TP
3638PID
3639Unique process ID for the task controlling the sandbox.
3640.TP
3641Prcs
3642Number of processes running in sandbox, including the controlling process.
3643.TP
3644RES
3645Resident Memory Size (KiB), sandbox non-swapped physical memory.
3646It is a sum of the RES values for all processes running in the sandbox.
3647.TP
3648RX(KB/s)
3649Network receive speed.
3650.TP
3651Sandbox Name
3652The name of the sandbox, if any.
3653.TP
3654SHR
3655Shared Memory Size (KiB), it reflects memory shared with other
3656processes. It is a sum of the SHR values for all processes running
3657in the sandbox, including the controlling process.
3658.TP
3659TX(KB/s)
3660Network transmit speed.
3661.TP
3662Uptime
3663Sandbox running time in hours:minutes:seconds format.
3664.TP
3665USER
3666The owner of the sandbox.
3667
3668.SH RESTRICTED SHELL
3669To configure a restricted shell, replace /bin/bash with /usr/bin/firejail in
3670/etc/passwd file for each user that needs to be restricted. Alternatively,
3671you can specify /usr/bin/firejail in adduser command:
3672
3673adduser \-\-shell /usr/bin/firejail username
3674
3675Additional arguments passed to firejail executable upon login are declared in /etc/firejail/login.users file.
3676
3677.SH SECURITY PROFILES
3678Several command line options can be passed to the program using
3679profile files. Firejail chooses the profile file as follows:
3680
36811. If a profile file is provided by the user with --profile=FILE option, the profile FILE is loaded. If a profile name is given, it is searched for first in the ~/.config/firejail directory and if not found then in /etc/firejail directory. Profile names do not include the .profile suffix. If there is a file with the same name as the given profile name, it will be used instead of doing the profile search. To force a profile search, prefix the profile name with a colon (:), eg. --profile=:PROFILE_NAME.
3682Example:
3683.PP
3684.RS
3685$ firejail --profile=/home/netblue/icecat.profile icecat
3686.br
3687Reading profile /home/netblue/icecat.profile
3688.br
3689[...]
3690.RE
3691
3692.PP
3693.RS
3694$ firejail --profile=icecat icecat-wrapper.sh
3695.br
3696Reading profile /etc/firejail/icecat.profile
3697.br
3698[...]
3699.RE
3700
37012. If a profile file with the same name as the application is present in ~/.config/firejail directory or
3702in /etc/firejail, the profile is loaded. ~/.config/firejail takes precedence over /etc/firejail. Example:
3703.PP
3704.RS
3705$ firejail icecat
3706.br
3707Command name #icecat#
3708.br
3709Found icecat profile in /home/netblue/.config/firejail directory
3710.br
3711Reading profile /home/netblue/.config/firejail/icecat.profile
3712.br
3713[...]
3714.RE
3715
37163. Use default.profile file if the sandbox
3717is started by a regular user, or server.profile file if the sandbox
3718is started by root. Firejail looks for these files in ~/.config/firejail directory, followed by /etc/firejail directory.
3719To disable default profile loading, use --noprofile command option. Example:
3720.PP
3721.RS
3722$ firejail
3723.br
3724Reading profile /etc/firejail/default.profile
3725.br
3726Parent pid 8553, child pid 8554
3727.br
3728Child process initialized
3729.br
3730[...]
3731.br
3732
3733.br
3734$ firejail \-\-noprofile
3735.br
3736Parent pid 8553, child pid 8554
3737.br
3738Child process initialized
3739.br
3740[...]
3741.RE
3742
3743See \fBman 5 firejail-profile\fR for profile file syntax information.
3744#ifdef HAVE_NETWORK
3745.SH TRAFFIC SHAPING
3746Network bandwidth is an expensive resource shared among all sandboxes running on a system.
3747Traffic shaping allows the user to increase network performance by controlling
3748the amount of data that flows into and out of the sandboxes.
3749
3750Firejail implements a simple rate-limiting shaper based on Linux command tc.
3751The shaper works at sandbox level, and can be used only for sandboxes configured with new network namespaces.
3752
3753Set rate-limits:
3754
3755 $ firejail --bandwidth=name|pid set network download upload
3756
3757Clear rate-limits:
3758
3759 $ firejail --bandwidth=name|pid clear network
3760
3761Status:
3762
3763 $ firejail --bandwidth=name|pid status
3764
3765where:
3766.br
3767 name - sandbox name
3768.br
3769 pid - sandbox pid
3770.br
3771 network - network interface as used by \-\-net option
3772.br
3773 download - download speed in KB/s (kilobyte per second)
3774.br
3775 upload - upload speed in KB/s (kilobyte per second)
3776
3777Example:
3778.br
3779 $ firejail \-\-name=mybrowser \-\-net=eth0 firefox &
3780.br
3781 $ firejail \-\-bandwidth=mybrowser set eth0 80 20
3782.br
3783 $ firejail \-\-bandwidth=mybrowser status
3784.br
3785 $ firejail \-\-bandwidth=mybrowser clear eth0
3786#endif
3787.SH LICENSE
3788This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
3789.PP
3790Homepage: https://firejail.wordpress.com
3791.SH SEE ALSO
3792.BR firemon (1),
3793.BR firecfg (1),
3794.BR firejail-profile (5),
3795.BR firejail-login (5),
3796.BR firejail-users (5),
3797.BR jailcheck (1)
3798
3799.UR https://github.com/netblue30/firejail/wiki
3800.UE ,
3801.UR https://github.com/netblue30/firejail
3802.UE
3803.\" vim: set filetype=groff :
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-06-29 10:05:51 +0000