Sandboxes for Linux now. First we have AppArmor.
AppArmor is a kind of sandbox. It is a mandatory
access control framework for Linux.
What AppArmor does is it confines programs
according to a set of rules that specify
what files a given program can access.
It’s available on a number of distributions,
including my recommended distributions, Debian and Arch Linux.
I do recommend using AppArmor and it is worth learning how to use.
AppArmor, SELinux and Grsecurity, which are other
security frameworks for Linux are discussed later.
And they are other methods of isolating
your Linux environment and hardening and securing it.
Another sandbox for Linux is Sandfox. It runs Firefox
and other apps in a sandbox, limiting their access
to the file system. And it works under Debian, Arch, Ubuntu.
Some Linux distributions have the sandbox command,
which you can see here.
To the distribution you use, you’ll have to see if that’s available.
There’s also Firejail, which describes itself as a SUID program
that reduces the risk of security breaches
by restricting the running environment of untrusted programs
using Linux namespaces and seccomp-bpf.
So you can think of this as just a lightweight sandbox.
And that’s what it looks like. And it’s easy to use
than, for example, AppArmor. You can download it from here.
I’m going to download it with WGET.
And there you go, it’s installed. That’s on Debian “jessie”.
Firejail is very easy to use. So let’s launch IceWeasel.
We have to use the application name Firefox
because that’s what it’s called in Debian.
There you go. IceWeasel launched sandboxed with Firejail.
Firejail also has something called the private mode,
which is a way of hiding all the fuzz in your home directory
from programs running inside the sandbox, which is a nice feature.
There we go. And that lists all the running sandboxes.
For a guide on how to fully use it,
check out the documentation link here.
Also there’s a link on Firefox sandboxing, so check that out.
The free BSD, the TrustedBSD system is used for sandboxing,
which is another mandatory access control framework,
on Mac framework. So this is worth looking at if you like BSD.