firejail 0.9.52

Firejail is a security sandbox tool, which utilizes Linux 3.x namespaces to setup restricted environments for untrusted applications. It works for console and graphical applications, servers, or even login sessions; by assigning them and their subprocesses a private view of globally shared kernel resources. Firejail isolates mount points, adds chrooting, filesystem writability or overlays, sandbox filesystem sharing, networking stack and firewall isolation, constrains interprocess communication, and separates processes. It comes with default profiles for Firefox or Evince, includes Seccomp and Linux caps support.

Tags c linux security process-isolation namespaces sandbox
License GNU GPL
State development

Recent Releases

0.9.5208 Dec 2017 10:25 minor feature: Modif: --allow-private-blacklists was deprecated; blacklisting. Read-only, read-write, tmpfs and noexec are allowed in Private home directories Modif: remount-proc-sys deprecated from firejail.config. Modif: follow-symlink-private-bin deprecated from firejail.config. Modif: --profile-path was deprecated. Enhancement: support Firejail user config directory in firecfg. Enhancement: disable DBus activation in firecfg. Enhancement; enumerate root directories in apparmor profile. Enhancement: /etc and /usr/share whitelisting support. Enhancement: globbing support for --private-bin. Feature: systemd-resolved integration. Feature: whitelisting /var directory in most profiles. Feature: GTK2, GTK3 and Qt4 private-lib support. Feature: --de-private-lib. Feature: test deployment of private-lib for the following. Applications: evince, galculator, gnome-calculator, Leafpad, mousepad, transmission-gtk, xcalc, xmr-stak-cpu, Atril, mate-color-select, tar, file, strings, gpicview, Eom, eog, gedit, pluma Feature: --writable-run-user. Feature: --rlimit-as. Feature: --rlimit-cpu. Feature: --timeout. Feature: profile build tool (--build). Feature: --netfilter.print. Feature: --netfilter6.print. Feature: netfilter template support. New profiles: upstreamed many profiles from the following sources: Https://github.com/chiraag-nataraj/firejail-profiles, Https://github.com/nyancat18/fe, Https://aur.archlinux.org/packages/firejail-profiles. New profiles: terasology, surf, rocketchat, clamscan, clamdscan. Clamdtop, freshclam, xmr-stak-cpu, amule, ardour4, ardour5, Brackets, calligra, calligraauthor, calligraconverter, calligraflow, Calligraplan, calligraplanwork, calligrasheets, calligrastage, Calligrawords, cin, dooble, dooble-qt4, fetchmail, freecad, freecadcmd, Google-earth,imagej, karbon, kdenlive, krita, linphone, lmms, macrofusion, Mpd, natron, Natron, ricochet, shotcut, teamspeak3, tor, tor-browser-en, Viber, x-terminal-emulator, zart, conky, arch-audit, ffmpeg,
0.9.5108 Sep 2017 03:15 minor feature: Work in progress!. -- netblue30 Mon, 12 Jun 2017 20:00:00 -0500. Firejail (0.9.50 rc1) baseline; urgency=low. Release pending!. Modif: --output split in two commands, --output and --output-stderr. Feature: per-profile disable-mnt (--disable-mnt). Feature: per-profile support to set X11 Xephyr screen size (--xephyr-screen). Feature: private /lib directory (--private-lib). Feature: disable CDROM/DVD drive (--nodvd). Feature: disable DVB devices (--notv). Feature: --profile.print. Enhancement: print all seccomp filters under --de enhancement: /proc/sys mounting. Enhancement: rework IP address assingment for --net options. Enhancement: support for newer Xpra versions (2.1+) -. Set xpra-attach yes in /etc/firejail/firejail.config Enhancement: all profiles use a standard layout style. Enhancement: create /usr/local for firecfg if the directory doesn't exist. Enhancement: allow full paths in --private-bin. Seccomp feature: --memory-deny-write-execute. Seccomp feature: seccomp post-exec. Seccomp feature: block secondary architecture (--seccomp.block_secondary). Seccomp feature: seccomp syscall groups. Seccomp enhancement: print all seccomp filters under --de seccomp enhancement: default seccomp list update. New profiles: curl, mplayer2, SMPlayer, Calibre, ebook-viewer, KWrite. New profiles: Geary, Liferea, peek, silentarmy, IntelliJ IDEA. New profiles: Android Studio, electron, riot-web, Extreme Tux Racer. New profiles: Frozen Bubble, Open Invaders, Pingus, Simutrans, SuperTux. New profiles: telegram-desktop, arm, rambox, apktool, baobab, dex2jar, gitg. New profiles: hashcat, obs, picard, remmina, sdat2img, soundconverter. New profiles: truecraft, gnome-twitch, tuxguitar, musescore, neverball. New profiles: sqlitebrowse, Yandex Browser, minetest.
0.9.4813 Jun 2017 06:25 minor feature: Modifs: whitelisted Transmission, Deluge, qBitTorrent, KTorrent;. Please use /Downloads directory for saving files Modifs: AppArmor made optional; a warning is printed on the screen if the sandbox fails to load the AppArmor profile. Feature: --novideo. Feature: drop discretionary access control capabilities for. Root sandboxes Feature: added /etc/firejail/globals.local for global customizations. Feature: profile support in overlayfs mode. New profiles: vym, darktable, Waterfox, digiKam, Catfish, HandBrake.
0.9.4618 May 2017 03:15 minor feature: Security: split most of networking code in a separate executable. Security: split seccomp filter code configuration in a separate executable. Security: split file copying in private option in a separate executable. Feature: disable gnupg and systemd directories under /run/user. Feature: test coverage (gcov) support. Feature: allow root user access to /dev/shm (--noblacklist=/dev/shm). Feature: private /opt directory (--private-opt, profile support). Feature: private /srv directory (--private-srv, profile support). Feature: spoof machine-id (--machine-id, profile support). Feature: allow blacklists under --private (--allow-private-blacklist. Profile support) Feature: user-defined /etc/hosts file (--hosts-file, profile support). Feature: support for the real /var/log directory (--writable-var-log. Profile support) Feature: config support for firejail prompt in terminals. Feature: AppImage type 2 support. Feature: pass command line arguments to appimages. Feature: allow non-seccomp setup for OverlayFS sandboxes - more work to come. Feature: added a number of Python scripts for handling sandboxes. Feature: allow local customization using.local files under /etc/firejail. Feature: follow-symlink-as-user runtime config option in. /etc/firejail/firejail.config. Feature: follow-symlink-private-bin option in /etc/firejail/firejail.config. Feature: xvfb X11 server support (--x11=xvfb). Feature: allow /tmp directory in mkdir and mkfile profile commands. Feature: implemented --noblacklist command, profile support. Feature: config support to disable access to /mnt and /media (disable-mnt). Feature: config support to disable join (join). Feature: disabled Go, Rust, and OpenSSL in disable-devel.conf. Feature: support overlay, overlay-named and overlay-tmpfs in profile files. Feature: allow PulseAudio sockets in --private-tmp. Feature: ---sound support in firecfg. Feature: added support for sandboxing Xpra, Xvfb and Xephyr in. Independent sandboxes w
0.9.46-rc108 Apr 2017 03:15 minor feature: Development version, work in progress. Security: split most of networking code in a separate executable. Security: split seccomp filter code configuration in a separate executable. Security: split file copying in private option in a separate executable. Feature: disable gnupg and systemd directories under /run/user. Feature: test coverage (gcov) support. Feature: allow root user access to /dev/shm (--noblacklist=/dev/shm). Feature: private /opt directory (--private-opt, profile support). Feature: private /srv directory (--private-srv, profile support). Feature: spoof machine-id (--machine-id, profile support). Feature: allow blacklists under --private (--allow-private-blacklist. Profile support) Feature: user-defined /etc/hosts file (--hosts-file, profile support). Feature: support for the real /var/log directory (--writable-var-log. Profile support) Feature: config support for firejail prompt in terminals. Feature: AppImage type 2 support. Feature: pass command line arguments to appimages. Feature: allow non-seccomp setup for OverlayFS sandboxes - more work to come. Feature: added a number of Python scripts for handling sandboxes. Feature: allow local customization using.local files under /etc/firejail. Feature: follow-symlink-as-user runtime config option in. /etc/firejail/firejail.config. Feature: follow-symlink-private-bin option in /etc/firejail/firejail.config. Feature: xvfb X11 server support (--x11=xvfb). Feature: allow /tmp directory in mkdir and mkfile profile commands. Feature: implemented --noblacklist command, profile support. Feature: config support to disable access to /mnt and /media (disable-mnt). Feature: config support to disable join (join). Feature: disabled Go, Rust, and OpenSSL in disable-devel.conf. New profiles: xiphos, Tor Browser Bundle, display (imagemagik), Wire. New profiles: mumble, zoom, Guayadeque, qemu, keypass2, xed, pluma. New profiles: Cryptocat, Bless, Gnome 2048, Gnome Calculator. New profiles:
0.9.4422 Oct 2016 03:25 minor feature: CVE-2016-7545 submitted by Aleksey Manevich. Modifs: removed man firejail-config. Modifs: --private-tmp whitelists /tmp/.X11-unix directory. Modifs: Nvidia drivers added to --private-dev. Modifs: /srv supported by --whitelist. Feature: allow user access to /sys/fs (--noblacklist=/sys/fs). Feature: support starting/joining sandbox is a single command. (--join-or-start). Feature: X11 detection support for --audit. Feature: assign a name to the interface connected to the bridge. (--veth-name). Feature: all user home directories are visible (--allusers). Feature: add files to sandbox container (--put). Feature: blocking x11 (--x11=block). Feature: X11 security extension (--x11=xorg). Feature: disable 3D hardware acceleration (--no3d). Feature: x11 xpra, x11 xephyr, x11 block, allusers, no3d profile commands. Feature: move files in sandbox (--put). Feature: accept wildcard patterns in user name field of restricted. Shell login feature New profiles: qpdfview, mupdf, Luminance HDR, Synfig Studio, Gimp, Inkscape. New profiles: feh, ranger, zathura, 7z, keepass, keepassx. New profiles: claws-mail, mutt, git, emacs, vim, xpdf, VirtualBox, OpenShot. New profiles: Flowblade, Eye of GNOME (eog), Evolution.
0.9.4209 Sep 2016 03:15 minor security: Security: --whitelist deleted files, submitted by Vasya Novikov. Security: disable x32 ABI in seccomp, submitted by Jann Horn. Security: tighten --chroot, submitted by Jann Horn. Security: terminal sandbox escape, submitted by Stephan Sokolow. Security: several TOCTOU submitted by Aleksey Manevich. Modifs: bringing back --private-home option. Modifs: deprecated --user option, please use "sudo -u username firejail". Modifs: allow symlinks in home directory for --whitelist option. Modifs: Firejail prompt is enabled by env variable FIREJAIL_PROMPT="yes". Modifs: recursive mkdir. Modifs: include /dev/snd in --private-dev. Modifs: seccomp filter update. Modifs: release archives moved to.xz format. Feature: AppImage support (--appimage). Feature: AppArmor support (--apparmor). Feature: Ubuntu snap support (/etc/firejail/snap.profile). Feature: Sandbox auditing support (--audit). Feature: remove environment variable (--rmenv). Feature: noexec support (--noexec). Feature: clean local overlay storage directory (--overlay-clean). Feature: store and reuse overlay (--overlay-named). Feature: allow deging inside the sandbox with gdb and strace. (--allow-degers). Feature: mkfile profile command. Feature: quiet profile command. Feature: x11 profile command. Feature: option to desktop files (firecfg --). Compile time: Busybox support (--enable-busybox-workaround). Compile time: disable overlayfs (--disable-overlayfs). Compile time: disable whitlisting (--disable-whitelist). Compile time: disable global config (--disable-globalcfg). Run time: enable/disable overlayfs (overlayfs yes/no). Run time: enable/disable quiet as default (quiet-by-default yes/no). Run time: user-defined network filter (netfilter-default). Run time: enable/disable whitelisting (whitelist yes/no). Run time: enable/disable remounting of /proc and /sys. (remount-proc-sys yes/no). Run time: enable/disable chroot desktop features (chroot-desktop yes/no). Profile
0.9.4025 May 2016 03:15 minor feature: Added --nice option. Added --x11 option. Added --x11=xpra option. Added --x11=xephyr option. Added --cpu.print option. Added filetransfer options --ls and --get. Added --writable-etc and --writable-var options. Added --read-only option. Added mkdir, ipc-namespace, and nosound profile commands. Added net, ip, defaultgw, ip6, mac, mtu and iprange profile commands. --version also prints compile options. --output option also redirects stderr. Added compile-time option to restrict --net= to root only. Run time config support, man firejail-config. Added firecfg utility. AppArmor default seccomp filter update. Disable STUN/WebRTC in default netfilter configuration. New profiles: lxterminal, Epiphany, cherrytree, Polari, Vivaldi, Atril. New profiles: qutebrowser, SlimJet, Battle for Wesnoth, Hedgewars. New profiles: qTox, OpenSSH client, OpenBox, Dillo, cmus, dnsmasq. New profiles: PaleMoon, Icedove, abrowser, 0ad, netsurf, Warzone2100. New profiles: okular, gwenview, Google-Play-Music-Desktop-Player. New profiles: Aweather, Stellarium, gpredict, quiterss, cyberfox. New profiles: generic Ubuntu snap application profile, xplayer. New profiles: xreader, xviewer, mcabber. Generic.profile renamed default.profile. Build rpm packages using "make rpms".
0.9.40-rc105 May 2016 01:15 major feature: Added a couple of options: --nice, --x11, --cpu.print, --ls, --get, --writable-etc, --writable-var. New profile commands: mkdir, ipc-namespace, nosound, net, ip, defaultgw, ip6, mac, mtu and iprange Added compile-time option to restrict --net= to root only, run time config support, man firejail-config. Added firecfg utility, AppArmor fixes. The default seccomp filter was updated. Disabled STUN/WebRTC in default netfilter configuration. New profiles include: lxterminal, Epiphany, cherrytree, Polari, Vivaldi, Atril, qutebrowser, SlimJet, Battle for Wesnoth, Hedgewars, qTox, OpenSSH client, OpenBox, Dillo, cmus, dnsmasq, PaleMoon, Icedove, abrowser, 0ad, netsurf, Warzone2100, okular, gwenview, Google-Play-Music-Desktop-Player, Aweather, Stellarium, gpredict, quiterss, cyberfox, and a generic Ubuntu snap application profile. And some bugfixes.
0.9.2831 Jul 2015 14:05 bugfix: network scanning, --scan option. interface MAC address support, --mac option. IP address range, --iprange option. traffic shaping, --bandwidth option. reworked printing of network status at startup. man pages rework. added firejail-login man page. added GNU Icecat, FileZilla, Pidgin, XChat, Empathy, DeaDBeeF default profiles. added an /etc/firejail/disable-common.inc file to hold common directory blacklists. blacklist Opera and Chrome/Chromium config directories in profile files. support noroot option for profile files. enabled noroot in default profile files. bugfixes. -- netblue30 Sat, 1 Aug 2015 08:00:00 -0500.
0.9.2710 May 2015 20:45 bugfix: work in progress. * network scanning. * interface MAC address support. * reworked network status printed when the sandbox starts. * bugfixes. -- netblue30 Sun, 9 May 2015 08:00:00 -0500.
0.9.2630 Apr 2015 10:45 bugfix: Private dev directory. Private.keep option for whitelisting home files in a new private directory. User namespaces support, noroot option. Added Deluge and qBittorent profiles. Bugfixes.
0.9.2406 Apr 2015 16:45 bugfix: Whitelist and blacklist seccomp filters. Doubledash option. --shell=none support. Netfilter file support in profile files. DNS server support in profile files. Added --dns.print option. Added default profiles for Audacious, Clementine, Gnome-MPlayer, Rhythmbox and Totem. Added --caps.drop=all in default profiles. New syscalls in default seccomp filter: sysfs, sysctl, adjtimex, kcmp, clock_adjtime, lookup_dcookie, perf_event_open, fanotify_init. Bugfix: using /proc/sys/kernel/pid_max for the max number of pids. Two build patches from Reiner Herman. Man page patch from Reiner Herman.
0.9.2324 Mar 2015 22:25 minor bugfix: Ongoing development. Two build patches and a new man page. Netfilter file support in profile. --caps.drop=all in default profiles. Doubledash option. --shell=none support in profile files. DNS server support in profile files. Added --dns.print option. Whitelist seccomp filters. New syscalls in default seccomp filter: sysfs, sysctl, adjtimex, kcmp. clock_adjtime, lookup_dcookie, perf_event_open, fanotify_init. Bugfix: using /proc/sys/kernel/pid_max for the max number of pids.
0.9.2210 Mar 2015 10:05 bugfix: Replaced --noip option with --ip=none. Container stdout logging and log rotation. Added process_vm_readv, process_vm_writev and mknod to. default seccomp blacklist. Added CAP_MKNOD to default caps blacklist. Blacklist and whitelist custom Linux capabilities filters. macvlan device driver support for --net option. DNS server support, --dns option. Netfilter support. Monitor network statistics, --netstats option. Added profile for Mozilla Thunderbird/Icedove. overlay support for Linux kernels 3.18+. Bugfix: preserve .Xauthority file in private mode . Bugfix: check uid/gid for cgroup.
0.9.2116 Feb 2015 07:05 bugfix: this is a rolling development version todo: help and man support for all Container stdout logging and log rotation Added process_vm_readv and process_vm_writev to default seccomp blacklist Custom Linux capabilities whitefilter support bugfix: check uid/gid for cgroup replaced --noip option with --ip=none macvlan device driver support for --net option preserve .Xauthority file in private mode todo: preserve .Xauthority file in chroot mode DNS server support, --dns option netblue30 Sun, 15 Feb 2015 08:00:00 -0500
0.9.2003 Feb 2015 06:25 bugfix: utmp, btmp and wtmp enhancements create empty /var/log/wtmp and /var/log/btmp files in sandbox generate a new /var/run/utmp file in sandbox CPU affinity, --cpu option Linux control groups support, --cgroup option Opera web browser support VLC support Added "empty" attribute to seccomp command to remove the default syscall list form seccomp blacklist Added --nogroups option to disable supplementary groups for regular users. root user always runs without supplementary groups. firemon enhancements display the command that started the sandbox added --caps option to display capabilities for all sandboxes added --cgroup option to display the control groups for all sandboxes added --cpu option to display CPU affinity for all sandboxes added --seccomp option to display seccomp setting for all sandboxes New compile time options: --disable-chroot, --disable-bind bugfixes netblue30 Mon, 02 Feb 2015 08:00:00 -0500
0.9.1826 Dec 2014 08:05 bugfix: Support for tracing system, setuid, setgid, setfsuid, setfsgid syscalls Support for tracing setreuid, setregid, setresuid, setresguid syscalls Added profiles for transmission-gtk and transmission-qt bugfixes netblue30 Fri, 25 Dec 2014 10:00:00 -0500
0.9.1611 Nov 2014 03:15 bugfix: Configurable private home directory Configurable default user shell Software configuration support for --docdir and DESTDIR Profile file support for include, caps, seccomp and private keywords Dropbox profile file Linux capabilities and seccomp filters enabled by default for Firefox, Midori, Evince and Dropbox bugfixes netblue30 Tue, 4 Nov 2014 10:00:00 -0500
0.9.1427 Oct 2014 11:56 major feature: This release brings in support for user-defined seccomp blacklists, tracing filesystem and network accesses, bind mounts, process resource limits, monitoring ARP tables, route tables and interfaces, and a number of smaller features and bugfixes.
0.9.12.201 Oct 2014 19:17 minor bugfix: More pulseaudio fixes. The overlay option was temporarily disabled in this build.