1. Getting "Warning: failed to unmount /sys" on --chroot and --overlay 2. Startup warnings on Arch Linux: (all fine here) $ ./firejail Parent pid 2495, child pid 2496 Child process initialized $ (warnings) $ ./firejail --overlay Parent pid 2500, child pid 2501 OverlayFS configured in /home/ablive/.firejail/2500 directory Warning: /var/lock not mounted Warning: cannot find /var/run/utmp Warning: failed to unmount /sys Child process initialized $ (warnings) $ ./firejail --chroot=/media/mylinux Parent pid 2503, child pid 2504 Warning: cannot find /var/run/utmp Dropping all Linux capabilities and enforcing default seccomp filter Warning: failed to unmount /sys Child process initialized $ 5. Add IRC clients: KVIrc (KDE), BitchX (CLI), Smuxi, Konversation (KDE), HexChat, Irssi (CLI), WeeChat (CLI) RSS: Liferea, akregator (KDE), newsbeuter (CLI), rawdog, 6. Tests not working on Arch: profile_syntax.exp (profile syntax) fs_chroot.exp (chroot as user) private-etc.exp 7. Disable /dev/tcp in bash. Compiled time: --enable-net-redirections, --disable-net-redirections ksh and zsh seem to have it. Tests: a) cat /dev/tcp/www.google.com/80 echo -e "GET / HTTP/1.1\r\nhost: http://www.google.com\r\nConnection: close\r\n\r\n" >&3 cat <&3 c) A list of attacks http://www.lanmaster53.com/2011/05/7-linux-shells-using-built-in-tools/ 8. SELinux Firefox selinux disabled (RedHat): http://danwalsh.livejournal.com/72697.html Firefox selinux enabled (Gentoo hardened): http://blog.siphos.be/2015/08/why-we-do-confine-firefox/ "desktops are notoriously difficult to use a mandatory access control system on" 9. blacklist .muttrc, contains passwords in clear text 10. abstract unix socket bridge, example for ibus: before the sandbox is started socat UNIX-LISTEN:/tmp/mysoc,fork ABSTRACT-CONNECT:/tmp/dbus-awBoQTCc & in sandbox socat ABSTRACT-LISTEN:/tmp/dbus-awBoQTCc,fork UNIX-CONNECT:/tmp/mysock 11. autotest for config options: ./configure --enable-fatal-warnings --prefix=/usr ./configure --enable-fatal-warnings --disable-seccomp --prefix=/usr ./configure --enable-fatal-warnings --disable-chroot --prefix=/usr ./configure --enable-fatal-warnings --disable-bind --prefix=/usr 12. do not allow symlinks for --bind 13. While using --net=eth0 assign the name of the interface inside the sandbox as eth0 14. check chroot does not allow on symlinks 15. do not attempt to mount /sys if unmount fails $ firejail --noprofile --chroot=/tmp/chroot Parent pid 13915, child pid 13916 Warning: cannot mount tmpfs on top of /var/log Warning: cannot find /var/run/utmp Warning: cannot find home directory Dropping all Linux capabilities and enforcing default seccomp filter Warning: failed to unmount /sys Warning: failed to mount /sys Warning: cannot disable /sys/firmware directory Warning: cannot disable /sys/hypervisor directory Warning: cannot disable /sys/fs directory Warning: cannot disable /sys/module directory Warning: cannot disable /sys/power directory Child process initialized 16. add support for --ip, --iprange, --mac and --mtu for --interface option 17. private-home clashing with blacklist $ firejail --private-home=.mozilla Reading profile /etc/firejail/generic.profile Reading profile /etc/firejail/disable-mgmt.inc Reading profile /etc/firejail/disable-secret.inc Reading profile /etc/firejail/disable-common.inc ** Note: you can use --noprofile to disable generic.profile ** Parent pid 8193, child pid 8194 /run/firejail/mnt/cp: cannot access `/home/netblue/.mozilla': Permission denied Error system cp -a --parents:duplicate(381): No such file or directory Child process initialized $ ls -la total 4 drwx------ 3 test test 100 Nov 25 07:59 . drwxr-xr-x 3 65534 65534 60 Nov 25 07:59 .. -rw-r--r-- 1 test test 3392 Nov 25 07:59 .bashrc dr-x------ 2 65534 65534 40 Nov 24 17:53 .mozilla -rw------- 1 test test 0 Nov 25 07:59 .Xauthority 18. whitelist clashing with blacklist $ firejail --whitelist=~/.mozilla Reading profile /etc/firejail/generic.profile Reading profile /etc/firejail/disable-mgmt.inc Reading profile /etc/firejail/disable-secret.inc Reading profile /etc/firejail/disable-common.inc ** Note: you can use --noprofile to disable generic.profile ** Parent pid 9440, child pid 9441 Child process initialized $ ls -al total 8 drwx------ 3 netblue netblue 100 Nov 25 08:09 . drwxr-xr-x 3 65534 65534 60 Nov 25 08:09 .. -rw-r--r-- 1 netblue netblue 3392 Nov 25 08:09 .bashrc dr-x------ 2 65534 65534 40 Nov 24 17:53 .mozilla -rw------- 1 netblue netblue 51 Nov 25 08:09 .Xauthority 19. Try --overlay on a Ubuntu 14.04 32bit.Without adding --dns, there will be no network connectivity - see issue 151 20. Check this out: I was messing around with my fstab, and found out that firejail can't have /usr/bin mounted in read-only. Here's what my fstab looks like now: /dev/mapper/asdf-home /home ext4 nosuid,noatime,nodev 0 2 /dev/mapper/asdf-opt /opt ext4 discard,noatime,nosuid 0 2 /dev/mapper/asdf-usr--bin /usr/bin ext4 defaults,nosuid,noatime,rw 0 2 /dev/mapper/asdf-usr--local /usr/local ext4 defaults,nosuid,noatime,ro 0 2 /dev/mapper/asdf-usr--sbin /usr/sbin ext4 defaults,nosuid,,noatime,ro 0 2 /dev/mapper/asdf-var /var ext4 discard,noatime,nodev,nosuid 0 2 tmpfs /tmp tmpfs noatime,nosuid,nodev,size=2G 0 1