diff options
-rw-r--r-- | src/man/firejail.txt | 495 |
1 files changed, 247 insertions, 248 deletions
diff --git a/src/man/firejail.txt b/src/man/firejail.txt index e6eaa1685..c3981336d 100644 --- a/src/man/firejail.txt +++ b/src/man/firejail.txt | |||
@@ -99,33 +99,33 @@ $ firejail --allusers | |||
99 | \fB\-\-apparmor | 99 | \fB\-\-apparmor |
100 | Enable AppArmor confinement. For more information, please see \fBAPPARMOR\fR section below. | 100 | Enable AppArmor confinement. For more information, please see \fBAPPARMOR\fR section below. |
101 | .TP | 101 | .TP |
102 | \fB\-\-appimage | 102 | \fB\-\-apparmor.print=name|pid |
103 | Sandbox an AppImage (https://appimage.org/) application. If the sandbox is started | 103 | Print the AppArmor confinement status for the sandbox identified by name or by PID. |
104 | as a regular user, nonewprivs and a default capabilities filter are enabled. | ||
105 | .br | 104 | .br |
106 | 105 | ||
107 | .br | 106 | .br |
108 | Example: | 107 | Example: |
109 | .br | 108 | .br |
110 | $ firejail --appimage krita-3.0-x86_64.appimage | 109 | $ firejail \-\-apparmor.print=browser |
111 | .br | 110 | .br |
112 | $ firejail --appimage --private krita-3.0-x86_64.appimage | 111 | 5074:netblue:/usr/bin/firejail /usr/bin/firefox-esr |
113 | .br | 112 | .br |
114 | $ firejail --appimage --net=none --x11 krita-3.0-x86_64.appimage | 113 | AppArmor: firejail-default enforce |
115 | 114 | ||
116 | .TP | 115 | .TP |
117 | \fB\-\-apparmor.print=name|pid | 116 | \fB\-\-appimage |
118 | Print the AppArmor confinement status for the sandbox identified by name or by PID. | 117 | Sandbox an AppImage (https://appimage.org/) application. If the sandbox is started |
118 | as a regular user, nonewprivs and a default capabilities filter are enabled. | ||
119 | .br | 119 | .br |
120 | 120 | ||
121 | .br | 121 | .br |
122 | Example: | 122 | Example: |
123 | .br | 123 | .br |
124 | $ firejail \-\-apparmor.print=browser | 124 | $ firejail --appimage krita-3.0-x86_64.appimage |
125 | .br | 125 | .br |
126 | 5074:netblue:/usr/bin/firejail /usr/bin/firefox-esr | 126 | $ firejail --appimage --private krita-3.0-x86_64.appimage |
127 | .br | 127 | .br |
128 | AppArmor: firejail-default enforce | 128 | $ firejail --appimage --net=none --x11 krita-3.0-x86_64.appimage |
129 | 129 | ||
130 | .TP | 130 | .TP |
131 | \fB\-\-audit | 131 | \fB\-\-audit |
@@ -701,10 +701,6 @@ Example: | |||
701 | $ firejail --keep-var-tmp | 701 | $ firejail --keep-var-tmp |
702 | 702 | ||
703 | .TP | 703 | .TP |
704 | \fB\-\-ls=name|pid dir_or_filename | ||
705 | List files in sandbox container, see \fBFILE TRANSFER\fR section for more details. | ||
706 | |||
707 | .TP | ||
708 | \fB\-\-list | 704 | \fB\-\-list |
709 | List all sandboxes, see \fBMONITORING\fR section for more details. | 705 | List all sandboxes, see \fBMONITORING\fR section for more details. |
710 | .br | 706 | .br |
@@ -720,7 +716,10 @@ $ firejail \-\-list | |||
720 | .br | 716 | .br |
721 | 7064:netblue::firejail \-\-noroot xterm | 717 | 7064:netblue::firejail \-\-noroot xterm |
722 | .br | 718 | .br |
723 | $ | 719 | .TP |
720 | \fB\-\-ls=name|pid dir_or_filename | ||
721 | List files in sandbox container, see \fBFILE TRANSFER\fR section for more details. | ||
722 | |||
724 | .TP | 723 | .TP |
725 | \fB\-\-mac=address | 724 | \fB\-\-mac=address |
726 | Assign MAC addresses to the last network interface defined by a \-\-net option. This option | 725 | Assign MAC addresses to the last network interface defined by a \-\-net option. This option |
@@ -735,7 +734,6 @@ $ firejail \-\-net=eth0 \-\-mac=00:11:22:33:44:55 firefox | |||
735 | .TP | 734 | .TP |
736 | \fB\-\-machine-id | 735 | \fB\-\-machine-id |
737 | Spoof id number in /etc/machine-id file - a new random id is generated inside the sandbox. | 736 | Spoof id number in /etc/machine-id file - a new random id is generated inside the sandbox. |
738 | .br | ||
739 | Note that this breaks audio support. Enable it when sound is not required. | 737 | Note that this breaks audio support. Enable it when sound is not required. |
740 | .br | 738 | .br |
741 | 739 | ||
@@ -816,6 +814,24 @@ $ sudo ifconfig br1 10.10.30.1/24 | |||
816 | $ firejail \-\-net=br0 \-\-net=br1 | 814 | $ firejail \-\-net=br0 \-\-net=br1 |
817 | 815 | ||
818 | .TP | 816 | .TP |
817 | \fB\-\-net=none | ||
818 | Enable a new, unconnected network namespace. The only interface | ||
819 | available in the new namespace is a new loopback interface (lo). | ||
820 | Use this option to deny | ||
821 | network access to programs that don't really need network access. | ||
822 | .br | ||
823 | |||
824 | .br | ||
825 | Example: | ||
826 | .br | ||
827 | $ firejail \-\-net=none vlc | ||
828 | .br | ||
829 | |||
830 | .br | ||
831 | Note: \-\-net=none can crash the application on some platforms. | ||
832 | In these cases, it can be replaced with \-\-protocol=unix. | ||
833 | |||
834 | .TP | ||
819 | \fB\-\-net=ethernet_interface|wireless_interface | 835 | \fB\-\-net=ethernet_interface|wireless_interface |
820 | Enable a new network namespace and connect it | 836 | Enable a new network namespace and connect it |
821 | to this ethernet interface using the standard Linux macvlan|ipvaln | 837 | to this ethernet interface using the standard Linux macvlan|ipvaln |
@@ -849,24 +865,6 @@ Example: | |||
849 | $ firejail \-\-net=tap0 \-\-ip=10.10.20.80 \-\-netmask=255.255.255.0 \-\-defaultgw=10.10.20.1 firefox | 865 | $ firejail \-\-net=tap0 \-\-ip=10.10.20.80 \-\-netmask=255.255.255.0 \-\-defaultgw=10.10.20.1 firefox |
850 | 866 | ||
851 | .TP | 867 | .TP |
852 | \fB\-\-net=none | ||
853 | Enable a new, unconnected network namespace. The only interface | ||
854 | available in the new namespace is a new loopback interface (lo). | ||
855 | Use this option to deny | ||
856 | network access to programs that don't really need network access. | ||
857 | .br | ||
858 | |||
859 | .br | ||
860 | Example: | ||
861 | .br | ||
862 | $ firejail \-\-net=none vlc | ||
863 | .br | ||
864 | |||
865 | .br | ||
866 | Note: \-\-net=none can crash the application on some platforms. | ||
867 | In these cases, it can be replaced with \-\-protocol=unix. | ||
868 | |||
869 | .TP | ||
870 | \fB\-\-net.print=name|pid | 868 | \fB\-\-net.print=name|pid |
871 | If a new network namespace is enabled, print network interface configuration for the sandbox specified by name or PID. Example: | 869 | If a new network namespace is enabled, print network interface configuration for the sandbox specified by name or PID. Example: |
872 | .br | 870 | .br |
@@ -1069,6 +1067,17 @@ Example: | |||
1069 | $ firejail --no3d firefox | 1067 | $ firejail --no3d firefox |
1070 | 1068 | ||
1071 | .TP | 1069 | .TP |
1070 | \fB\-\-noautopulse | ||
1071 | Disable automatic ~/.config/pulse init, for complex setups such as remote | ||
1072 | pulse servers or non-standard socket paths. | ||
1073 | .br | ||
1074 | |||
1075 | .br | ||
1076 | Example: | ||
1077 | .br | ||
1078 | $ firejail \-\-noautopulse firefox | ||
1079 | |||
1080 | .TP | ||
1072 | \fB\-\-noblacklist=dirname_or_filename | 1081 | \fB\-\-noblacklist=dirname_or_filename |
1073 | Disable blacklist for this directory or file. | 1082 | Disable blacklist for this directory or file. |
1074 | .br | 1083 | .br |
@@ -1158,6 +1167,14 @@ uid=1000(netblue) gid=1000(netblue) groups=1000(netblue) | |||
1158 | $ | 1167 | $ |
1159 | 1168 | ||
1160 | .TP | 1169 | .TP |
1170 | \fB\-\-nonewprivs | ||
1171 | Sets the NO_NEW_PRIVS prctl. This ensures that child processes | ||
1172 | cannot acquire new privileges using execve(2); in particular, | ||
1173 | this means that calling a suid binary (or one with file capabilities) | ||
1174 | does not result in an increase of privilege. This option | ||
1175 | is enabled by default if seccomp filter is activated. | ||
1176 | |||
1177 | .TP | ||
1161 | \fB\-\-noprofile | 1178 | \fB\-\-noprofile |
1162 | Do not use a security profile. | 1179 | Do not use a security profile. |
1163 | .br | 1180 | .br |
@@ -1210,14 +1227,6 @@ ping: icmp open socket: Operation not permitted | |||
1210 | $ | 1227 | $ |
1211 | 1228 | ||
1212 | .TP | 1229 | .TP |
1213 | \fB\-\-nonewprivs | ||
1214 | Sets the NO_NEW_PRIVS prctl. This ensures that child processes | ||
1215 | cannot acquire new privileges using execve(2); in particular, | ||
1216 | this means that calling a suid binary (or one with file capabilities) | ||
1217 | does not result in an increase of privilege. This option | ||
1218 | is enabled by default if seccomp filter is activated. | ||
1219 | |||
1220 | .TP | ||
1221 | \fB\-\-nosound | 1230 | \fB\-\-nosound |
1222 | Disable sound system. | 1231 | Disable sound system. |
1223 | .br | 1232 | .br |
@@ -1228,17 +1237,6 @@ Example: | |||
1228 | $ firejail \-\-nosound firefox | 1237 | $ firejail \-\-nosound firefox |
1229 | 1238 | ||
1230 | .TP | 1239 | .TP |
1231 | \fB\-\-noautopulse | ||
1232 | Disable automatic ~/.config/pulse init, for complex setups such as remote | ||
1233 | pulse servers or non-standard socket paths. | ||
1234 | .br | ||
1235 | |||
1236 | .br | ||
1237 | Example: | ||
1238 | .br | ||
1239 | $ firejail \-\-noautopulse firefox | ||
1240 | |||
1241 | .TP | ||
1242 | \fB\-\-notv | 1240 | \fB\-\-notv |
1243 | Disable DVB (Digital Video Broadcasting) TV devices. | 1241 | Disable DVB (Digital Video Broadcasting) TV devices. |
1244 | .br | 1242 | .br |
@@ -1318,6 +1316,16 @@ Example: | |||
1318 | $ firejail \-\-overlay firefox | 1316 | $ firejail \-\-overlay firefox |
1319 | 1317 | ||
1320 | .TP | 1318 | .TP |
1319 | \fB\-\-overlay-clean | ||
1320 | Clean all overlays stored in $HOME/.firejail directory. | ||
1321 | .br | ||
1322 | |||
1323 | .br | ||
1324 | Example: | ||
1325 | .br | ||
1326 | $ firejail \-\-overlay-clean | ||
1327 | |||
1328 | .TP | ||
1321 | \fB\-\-overlay-named=name | 1329 | \fB\-\-overlay-named=name |
1322 | Mount a filesystem overlay on top of the current filesystem. Unlike the regular filesystem container, | 1330 | Mount a filesystem overlay on top of the current filesystem. Unlike the regular filesystem container, |
1323 | the system directories are mounted read-write. All filesystem modifications go into the overlay. | 1331 | the system directories are mounted read-write. All filesystem modifications go into the overlay. |
@@ -1356,16 +1364,6 @@ Example: | |||
1356 | $ firejail \-\-overlay-tmpfs firefox | 1364 | $ firejail \-\-overlay-tmpfs firefox |
1357 | 1365 | ||
1358 | .TP | 1366 | .TP |
1359 | \fB\-\-overlay-clean | ||
1360 | Clean all overlays stored in $HOME/.firejail directory. | ||
1361 | .br | ||
1362 | |||
1363 | .br | ||
1364 | Example: | ||
1365 | .br | ||
1366 | $ firejail \-\-overlay-clean | ||
1367 | |||
1368 | .TP | ||
1369 | \fB\-\-private | 1367 | \fB\-\-private |
1370 | Mount new /root and /home/user directories in temporary | 1368 | Mount new /root and /home/user directories in temporary |
1371 | filesystems. All modifications are discarded when the sandbox is | 1369 | filesystems. All modifications are discarded when the sandbox is |
@@ -1376,6 +1374,7 @@ closed. | |||
1376 | Example: | 1374 | Example: |
1377 | .br | 1375 | .br |
1378 | $ firejail \-\-private firefox | 1376 | $ firejail \-\-private firefox |
1377 | |||
1379 | .TP | 1378 | .TP |
1380 | \fB\-\-private=directory | 1379 | \fB\-\-private=directory |
1381 | Use directory as user home. | 1380 | Use directory as user home. |
@@ -1387,17 +1386,26 @@ Example: | |||
1387 | $ firejail \-\-private=/home/netblue/firefox-home firefox | 1386 | $ firejail \-\-private=/home/netblue/firefox-home firefox |
1388 | 1387 | ||
1389 | .TP | 1388 | .TP |
1390 | \fB\-\-private-home=file,directory | 1389 | \fB\-\-private-bin=file,file |
1391 | Build a new user home in a temporary | 1390 | Build a new /bin in a temporary filesystem, and copy the programs in the list. |
1392 | filesystem, and copy the files and directories in the list in the | 1391 | If no listed file is found, /bin directory will be empty. |
1393 | new home. All modifications are discarded when the sandbox is | 1392 | The same directory is also bind-mounted over /sbin, /usr/bin, /usr/sbin and /usr/local/bin. |
1394 | closed. | 1393 | All modifications are discarded when the sandbox is closed. File globbing is supported, |
1394 | see \fBFILE GLOBBING\fR section for more details. | ||
1395 | .br | 1395 | .br |
1396 | 1396 | ||
1397 | .br | 1397 | .br |
1398 | Example: | 1398 | Example: |
1399 | .br | 1399 | .br |
1400 | $ firejail \-\-private-home=.mozilla firefox | 1400 | $ firejail \-\-private-bin=bash,sed,ls,cat |
1401 | .br | ||
1402 | Parent pid 20841, child pid 20842 | ||
1403 | .br | ||
1404 | Child process initialized | ||
1405 | .br | ||
1406 | $ ls /bin | ||
1407 | .br | ||
1408 | bash cat ls sed | ||
1401 | 1409 | ||
1402 | .TP | 1410 | .TP |
1403 | \fB\-\-private-cache | 1411 | \fB\-\-private-cache |
@@ -1411,26 +1419,51 @@ Example: | |||
1411 | $ firejail \-\-private-cache openbox | 1419 | $ firejail \-\-private-cache openbox |
1412 | 1420 | ||
1413 | .TP | 1421 | .TP |
1414 | \fB\-\-private-bin=file,file | 1422 | \fB\-\-private-dev |
1415 | Build a new /bin in a temporary filesystem, and copy the programs in the list. | 1423 | Create a new /dev directory. Only disc, dri, null, full, zero, tty, pts, ptmx, random, snd, urandom, video, log and shm devices are available. |
1416 | If no listed file is found, /bin directory will be empty. | ||
1417 | The same directory is also bind-mounted over /sbin, /usr/bin, /usr/sbin and /usr/local/bin. | ||
1418 | All modifications are discarded when the sandbox is closed. File globbing is supported, | ||
1419 | see \fBFILE GLOBBING\fR section for more details. | ||
1420 | .br | 1424 | .br |
1421 | 1425 | ||
1422 | .br | 1426 | .br |
1423 | Example: | 1427 | Example: |
1424 | .br | 1428 | .br |
1425 | $ firejail \-\-private-bin=bash,sed,ls,cat | 1429 | $ firejail \-\-private-dev |
1426 | .br | 1430 | .br |
1427 | Parent pid 20841, child pid 20842 | 1431 | Parent pid 9887, child pid 9888 |
1428 | .br | 1432 | .br |
1429 | Child process initialized | 1433 | Child process initialized |
1430 | .br | 1434 | .br |
1431 | $ ls /bin | 1435 | $ ls /dev |
1432 | .br | 1436 | .br |
1433 | bash cat ls sed | 1437 | cdrom cdrw dri dvd dvdrw full log null ptmx pts random shm snd sr0 tty urandom zero |
1438 | .br | ||
1439 | $ | ||
1440 | .TP | ||
1441 | \fB\-\-private-etc=file,directory | ||
1442 | Build a new /etc in a temporary | ||
1443 | filesystem, and copy the files and directories in the list. | ||
1444 | If no listed file is found, /etc directory will be empty. | ||
1445 | All modifications are discarded when the sandbox is closed. | ||
1446 | .br | ||
1447 | |||
1448 | .br | ||
1449 | Example: | ||
1450 | .br | ||
1451 | $ firejail --private-etc=group,hostname,localtime, \\ | ||
1452 | .br | ||
1453 | nsswitch.conf,passwd,resolv.conf | ||
1454 | |||
1455 | .TP | ||
1456 | \fB\-\-private-home=file,directory | ||
1457 | Build a new user home in a temporary | ||
1458 | filesystem, and copy the files and directories in the list in the | ||
1459 | new home. All modifications are discarded when the sandbox is | ||
1460 | closed. | ||
1461 | .br | ||
1462 | |||
1463 | .br | ||
1464 | Example: | ||
1465 | .br | ||
1466 | $ firejail \-\-private-home=.mozilla firefox | ||
1434 | 1467 | ||
1435 | .TP | 1468 | .TP |
1436 | \fB\-\-private-lib=file,directory | 1469 | \fB\-\-private-lib=file,directory |
@@ -1482,41 +1515,6 @@ $ ps | |||
1482 | $ | 1515 | $ |
1483 | .br | 1516 | .br |
1484 | 1517 | ||
1485 | |||
1486 | .TP | ||
1487 | \fB\-\-private-dev | ||
1488 | Create a new /dev directory. Only disc, dri, null, full, zero, tty, pts, ptmx, random, snd, urandom, video, log and shm devices are available. | ||
1489 | .br | ||
1490 | |||
1491 | .br | ||
1492 | Example: | ||
1493 | .br | ||
1494 | $ firejail \-\-private-dev | ||
1495 | .br | ||
1496 | Parent pid 9887, child pid 9888 | ||
1497 | .br | ||
1498 | Child process initialized | ||
1499 | .br | ||
1500 | $ ls /dev | ||
1501 | .br | ||
1502 | cdrom cdrw dri dvd dvdrw full log null ptmx pts random shm snd sr0 tty urandom zero | ||
1503 | .br | ||
1504 | $ | ||
1505 | .TP | ||
1506 | \fB\-\-private-etc=file,directory | ||
1507 | Build a new /etc in a temporary | ||
1508 | filesystem, and copy the files and directories in the list. | ||
1509 | If no listed file is found, /etc directory will be empty. | ||
1510 | All modifications are discarded when the sandbox is closed. | ||
1511 | .br | ||
1512 | |||
1513 | .br | ||
1514 | Example: | ||
1515 | .br | ||
1516 | $ firejail --private-etc=group,hostname,localtime, \\ | ||
1517 | .br | ||
1518 | nsswitch.conf,passwd,resolv.conf | ||
1519 | |||
1520 | .TP | 1518 | .TP |
1521 | \fB\-\-private-opt=file,directory | 1519 | \fB\-\-private-opt=file,directory |
1522 | Build a new /opt in a temporary | 1520 | Build a new /opt in a temporary |
@@ -2422,6 +2420,69 @@ Example: | |||
2422 | $ firejail --net=eth0 --x11=xephyr --xephyr-screen=640x480 firefox | 2420 | $ firejail --net=eth0 --x11=xephyr --xephyr-screen=640x480 firefox |
2423 | .br | 2421 | .br |
2424 | 2422 | ||
2423 | .SH APPARMOR | ||
2424 | .TP | ||
2425 | AppArmor support is disabled by default at compile time. Use --enable-apparmor configuration option to enable it: | ||
2426 | .br | ||
2427 | |||
2428 | .br | ||
2429 | $ ./configure --prefix=/usr --enable-apparmor | ||
2430 | .TP | ||
2431 | During software install, a generic AppArmor profile file, firejail-default, is placed in /etc/apparmor.d directory. The local customizations must be placed in /etc/apparmor.d/local/firejail-local. The profile needs to be loaded into the kernel by reloading apparmor.service, rebooting the system or running the following command as root: | ||
2432 | .br | ||
2433 | |||
2434 | .br | ||
2435 | # apparmor_parser -r /etc/apparmor.d/firejail-default | ||
2436 | .TP | ||
2437 | The installed profile is supplemental for main firejail functions and among other things does the following: | ||
2438 | .br | ||
2439 | |||
2440 | .br | ||
2441 | - Disable ptrace. With ptrace it is possible to inspect and hijack running programs. Usually this is needed only for debugging. You should have no problems running Chromium or Firefox. This feature is available only on Ubuntu kernels. | ||
2442 | .br | ||
2443 | |||
2444 | .br | ||
2445 | - Whitelist write access to several files under /run, /proc and /sys. | ||
2446 | .br | ||
2447 | |||
2448 | .br | ||
2449 | - Allow running programs only from well-known system paths, such as /bin, /sbin, /usr/bin etc. Those paths are available as read-only. Running programs and scripts from user home or other directories writable by the user is not allowed. | ||
2450 | .br | ||
2451 | |||
2452 | .br | ||
2453 | - Prevent using non-standard network sockets. Only unix, inet, inet6, netlink, raw and packet are allowed. | ||
2454 | .br | ||
2455 | |||
2456 | .br | ||
2457 | - Deny access to known sensitive paths like .snapshots. | ||
2458 | |||
2459 | .TP | ||
2460 | To enable AppArmor confinement on top of your current Firejail security features, pass \fB\-\-apparmor\fR flag to Firejail command line. You can also include \fBapparmor\fR command in a Firejail profile file. Example: | ||
2461 | .br | ||
2462 | |||
2463 | .br | ||
2464 | $ firejail --apparmor firefox | ||
2465 | |||
2466 | .SH AUDIT | ||
2467 | Audit feature allows the user to point out gaps in security profiles. The | ||
2468 | implementation replaces the program to be sandboxed with a test program. By | ||
2469 | default, we use faudit program distributed with Firejail. A custom test program | ||
2470 | can also be supplied by the user. Examples: | ||
2471 | |||
2472 | Running the default audit program: | ||
2473 | .br | ||
2474 | $ firejail --audit transmission-gtk | ||
2475 | |||
2476 | Running a custom audit program: | ||
2477 | .br | ||
2478 | $ firejail --audit=~/sandbox-test transmission-gtk | ||
2479 | |||
2480 | In the examples above, the sandbox configures transmission-gtk profile and | ||
2481 | starts the test program. The real program, transmission-gtk, will not be | ||
2482 | started. | ||
2483 | |||
2484 | Limitations: audit feature is not implemented for --x11 commands. | ||
2485 | |||
2425 | .SH DESKTOP INTEGRATION | 2486 | .SH DESKTOP INTEGRATION |
2426 | A symbolic link to /usr/bin/firejail under the name of a program, will start the program in Firejail sandbox. | 2487 | A symbolic link to /usr/bin/firejail under the name of a program, will start the program in Firejail sandbox. |
2427 | The symbolic link should be placed in the first $PATH position. On most systems, a good place | 2488 | The symbolic link should be placed in the first $PATH position. On most systems, a good place |
@@ -2477,6 +2538,35 @@ $ firejail --tree | |||
2477 | 2538 | ||
2478 | We provide a tool that automates all this integration, please see \fBman 1 firecfg\fR for more details. | 2539 | We provide a tool that automates all this integration, please see \fBman 1 firecfg\fR for more details. |
2479 | 2540 | ||
2541 | .SH EXAMPLES | ||
2542 | .TP | ||
2543 | \f\firejail | ||
2544 | Sandbox a regular /bin/bash session. | ||
2545 | .TP | ||
2546 | \f\firejail firefox | ||
2547 | Start Mozilla Firefox. | ||
2548 | .TP | ||
2549 | \f\firejail \-\-debug firefox | ||
2550 | Debug Firefox sandbox. | ||
2551 | .TP | ||
2552 | \f\firejail \-\-private firefox | ||
2553 | Start Firefox with a new, empty home directory. | ||
2554 | .TP | ||
2555 | \f\firejail --net=none vlc | ||
2556 | Start VLC in an unconnected network namespace. | ||
2557 | .TP | ||
2558 | \f\firejail \-\-net=eth0 firefox | ||
2559 | Start Firefox in a new network namespace. An IP address is | ||
2560 | assigned automatically. | ||
2561 | .TP | ||
2562 | \f\firejail \-\-net=br0 \-\-ip=10.10.20.5 \-\-net=br1 \-\-net=br2 | ||
2563 | Start a /bin/bash session in a new network namespace and connect it | ||
2564 | to br0, br1, and br2 host bridge devices. IP addresses are assigned | ||
2565 | automatically for the interfaces connected to br1 and b2 | ||
2566 | .TP | ||
2567 | \f\firejail \-\-list | ||
2568 | List all sandboxed processes. | ||
2569 | |||
2480 | .SH FILE GLOBBING | 2570 | .SH FILE GLOBBING |
2481 | .TP | 2571 | .TP |
2482 | Globbing is the operation that expands a wildcard pattern into the list of pathnames matching the pattern. Matching is defined by: | 2572 | Globbing is the operation that expands a wildcard pattern into the list of pathnames matching the pattern. Matching is defined by: |
@@ -2511,49 +2601,6 @@ $ firejail --blacklist=~/dir[1234] | |||
2511 | $ firejail --read-only=~/dir[1-4] | 2601 | $ firejail --read-only=~/dir[1-4] |
2512 | .br | 2602 | .br |
2513 | 2603 | ||
2514 | .SH APPARMOR | ||
2515 | .TP | ||
2516 | AppArmor support is disabled by default at compile time. Use --enable-apparmor configuration option to enable it: | ||
2517 | .br | ||
2518 | |||
2519 | .br | ||
2520 | $ ./configure --prefix=/usr --enable-apparmor | ||
2521 | .TP | ||
2522 | During software install, a generic AppArmor profile file, firejail-default, is placed in /etc/apparmor.d directory. The local customizations must be placed in /etc/apparmor.d/local/firejail-local. The profile needs to be loaded into the kernel by reloading apparmor.service, rebooting the system or running the following command as root: | ||
2523 | .br | ||
2524 | |||
2525 | .br | ||
2526 | # apparmor_parser -r /etc/apparmor.d/firejail-default | ||
2527 | .TP | ||
2528 | The installed profile is supplemental for main firejail functions and among other things does the following: | ||
2529 | .br | ||
2530 | |||
2531 | .br | ||
2532 | - Disable ptrace. With ptrace it is possible to inspect and hijack running programs. Usually this is needed only for debugging. You should have no problems running Chromium or Firefox. This feature is available only on Ubuntu kernels. | ||
2533 | .br | ||
2534 | |||
2535 | .br | ||
2536 | - Whitelist write access to several files under /run, /proc and /sys. | ||
2537 | .br | ||
2538 | |||
2539 | .br | ||
2540 | - Allow running programs only from well-known system paths, such as /bin, /sbin, /usr/bin etc. Those paths are available as read-only. Running programs and scripts from user home or other directories writable by the user is not allowed. | ||
2541 | .br | ||
2542 | |||
2543 | .br | ||
2544 | - Prevent using non-standard network sockets. Only unix, inet, inet6, netlink, raw and packet are allowed. | ||
2545 | .br | ||
2546 | |||
2547 | .br | ||
2548 | - Deny access to known sensitive paths like .snapshots. | ||
2549 | |||
2550 | .TP | ||
2551 | To enable AppArmor confinement on top of your current Firejail security features, pass \fB\-\-apparmor\fR flag to Firejail command line. You can also include \fBapparmor\fR command in a Firejail profile file. Example: | ||
2552 | .br | ||
2553 | |||
2554 | .br | ||
2555 | $ firejail --apparmor firefox | ||
2556 | |||
2557 | .SH FILE TRANSFER | 2604 | .SH FILE TRANSFER |
2558 | These features allow the user to inspect the filesystem container of an existing sandbox | 2605 | These features allow the user to inspect the filesystem container of an existing sandbox |
2559 | and transfer files from the container to the host filesystem. | 2606 | and transfer files from the container to the host filesystem. |
@@ -2602,68 +2649,6 @@ $ firejail \-\-get=mybrowser ~/Downloads/xpra-clipboard.png | |||
2602 | $ firejail \-\-put=mybrowser xpra-clipboard.png ~/Downloads/xpra-clipboard.png | 2649 | $ firejail \-\-put=mybrowser xpra-clipboard.png ~/Downloads/xpra-clipboard.png |
2603 | .br | 2650 | .br |
2604 | 2651 | ||
2605 | .SH TRAFFIC SHAPING | ||
2606 | Network bandwidth is an expensive resource shared among all sandboxes running on a system. | ||
2607 | Traffic shaping allows the user to increase network performance by controlling | ||
2608 | the amount of data that flows into and out of the sandboxes. | ||
2609 | |||
2610 | Firejail implements a simple rate-limiting shaper based on Linux command tc. | ||
2611 | The shaper works at sandbox level, and can be used only for sandboxes configured with new network namespaces. | ||
2612 | |||
2613 | Set rate-limits: | ||
2614 | |||
2615 | $ firejail --bandwidth=name|pid set network download upload | ||
2616 | |||
2617 | Clear rate-limits: | ||
2618 | |||
2619 | $ firejail --bandwidth=name|pid clear network | ||
2620 | |||
2621 | Status: | ||
2622 | |||
2623 | $ firejail --bandwidth=name|pid status | ||
2624 | |||
2625 | where: | ||
2626 | .br | ||
2627 | name - sandbox name | ||
2628 | .br | ||
2629 | pid - sandbox pid | ||
2630 | .br | ||
2631 | network - network interface as used by \-\-net option | ||
2632 | .br | ||
2633 | download - download speed in KB/s (kilobyte per second) | ||
2634 | .br | ||
2635 | upload - upload speed in KB/s (kilobyte per second) | ||
2636 | |||
2637 | Example: | ||
2638 | .br | ||
2639 | $ firejail \-\-name=mybrowser \-\-net=eth0 firefox & | ||
2640 | .br | ||
2641 | $ firejail \-\-bandwidth=mybrowser set eth0 80 20 | ||
2642 | .br | ||
2643 | $ firejail \-\-bandwidth=mybrowser status | ||
2644 | .br | ||
2645 | $ firejail \-\-bandwidth=mybrowser clear eth0 | ||
2646 | |||
2647 | .SH AUDIT | ||
2648 | Audit feature allows the user to point out gaps in security profiles. The | ||
2649 | implementation replaces the program to be sandboxed with a test program. By | ||
2650 | default, we use faudit program distributed with Firejail. A custom test program | ||
2651 | can also be supplied by the user. Examples: | ||
2652 | |||
2653 | Running the default audit program: | ||
2654 | .br | ||
2655 | $ firejail --audit transmission-gtk | ||
2656 | |||
2657 | Running a custom audit program: | ||
2658 | .br | ||
2659 | $ firejail --audit=~/sandbox-test transmission-gtk | ||
2660 | |||
2661 | In the examples above, the sandbox configures transmission-gtk profile and | ||
2662 | starts the test program. The real program, transmission-gtk, will not be | ||
2663 | started. | ||
2664 | |||
2665 | Limitations: audit feature is not implemented for --x11 commands. | ||
2666 | |||
2667 | .SH MONITORING | 2652 | .SH MONITORING |
2668 | Option \-\-list prints a list of all sandboxes. The format | 2653 | Option \-\-list prints a list of all sandboxes. The format |
2669 | for each process entry is as follows: | 2654 | for each process entry is as follows: |
@@ -2799,34 +2784,48 @@ adduser \-\-shell /usr/bin/firejail username | |||
2799 | 2784 | ||
2800 | Additional arguments passed to firejail executable upon login are declared in /etc/firejail/login.users file. | 2785 | Additional arguments passed to firejail executable upon login are declared in /etc/firejail/login.users file. |
2801 | 2786 | ||
2802 | .SH EXAMPLES | 2787 | .SH TRAFFIC SHAPING |
2803 | .TP | 2788 | Network bandwidth is an expensive resource shared among all sandboxes running on a system. |
2804 | \f\firejail | 2789 | Traffic shaping allows the user to increase network performance by controlling |
2805 | Sandbox a regular /bin/bash session. | 2790 | the amount of data that flows into and out of the sandboxes. |
2806 | .TP | 2791 | |
2807 | \f\firejail firefox | 2792 | Firejail implements a simple rate-limiting shaper based on Linux command tc. |
2808 | Start Mozilla Firefox. | 2793 | The shaper works at sandbox level, and can be used only for sandboxes configured with new network namespaces. |
2809 | .TP | 2794 | |
2810 | \f\firejail \-\-debug firefox | 2795 | Set rate-limits: |
2811 | Debug Firefox sandbox. | 2796 | |
2812 | .TP | 2797 | $ firejail --bandwidth=name|pid set network download upload |
2813 | \f\firejail \-\-private firefox | 2798 | |
2814 | Start Firefox with a new, empty home directory. | 2799 | Clear rate-limits: |
2815 | .TP | 2800 | |
2816 | \f\firejail --net=none vlc | 2801 | $ firejail --bandwidth=name|pid clear network |
2817 | Start VLC in an unconnected network namespace. | 2802 | |
2818 | .TP | 2803 | Status: |
2819 | \f\firejail \-\-net=eth0 firefox | 2804 | |
2820 | Start Firefox in a new network namespace. An IP address is | 2805 | $ firejail --bandwidth=name|pid status |
2821 | assigned automatically. | 2806 | |
2822 | .TP | 2807 | where: |
2823 | \f\firejail \-\-net=br0 \-\-ip=10.10.20.5 \-\-net=br1 \-\-net=br2 | 2808 | .br |
2824 | Start a /bin/bash session in a new network namespace and connect it | 2809 | name - sandbox name |
2825 | to br0, br1, and br2 host bridge devices. IP addresses are assigned | 2810 | .br |
2826 | automatically for the interfaces connected to br1 and b2 | 2811 | pid - sandbox pid |
2827 | .TP | 2812 | .br |
2828 | \f\firejail \-\-list | 2813 | network - network interface as used by \-\-net option |
2829 | List all sandboxed processes. | 2814 | .br |
2815 | download - download speed in KB/s (kilobyte per second) | ||
2816 | .br | ||
2817 | upload - upload speed in KB/s (kilobyte per second) | ||
2818 | |||
2819 | Example: | ||
2820 | .br | ||
2821 | $ firejail \-\-name=mybrowser \-\-net=eth0 firefox & | ||
2822 | .br | ||
2823 | $ firejail \-\-bandwidth=mybrowser set eth0 80 20 | ||
2824 | .br | ||
2825 | $ firejail \-\-bandwidth=mybrowser status | ||
2826 | .br | ||
2827 | $ firejail \-\-bandwidth=mybrowser clear eth0 | ||
2828 | |||
2830 | .SH LICENSE | 2829 | .SH LICENSE |
2831 | This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. | 2830 | This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. |
2832 | .PP | 2831 | .PP |