2

On Linux, Firejail (https://firejail.wordpress.com/) offers an easy way to sandbox web browsers and other programs.

Is there an easy way to sandbox a web browser on OpenBSD ?

(reserve question: is there a non-easy way ?)

2

Some developers are working on a sandboxed version of Chromium. I don't know if there is a public diff or not. With pledge and unveil, they can limit the syscalls used and the directories viewed by Chromium.

Firefox only uses pledge, so it has not whitelisted/blacklisted directories.

  • 2
    Thanks for the link on unveil. I was aware of pledge in OpenBSD Chromium, it seems to me that in Linux Chromium implements a similar function leveraging seccomp-bfp and namespaces. - see chromium://sandbox on Linux - – puzzle Aug 9 '18 at 22:14
  • 2
    Yes, both are similar but you can't disable the sandbox on OpenBSD because the sandbox restrictions are part of the code of Chromium or Firefox. The OpenBSD developers are using the layers separation which both browsers include for Linux. – Rufo El Magufo Aug 9 '18 at 22:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.