On Linux, Firejail (https://firejail.wordpress.com/) offers an easy way to sandbox web browsers and other programs.

Is there an easy way to sandbox a web browser on OpenBSD ?

(reserve question: is there a non-easy way ?)

1 Answer 1


Some developers are working on a sandboxed version of Chromium. I don't know if there is a public diff or not. With pledge and unveil, they can limit the syscalls used and the directories viewed by Chromium.

Firefox only uses pledge, so it has not whitelisted/blacklisted directories.

  • 2
    Thanks for the link on unveil. I was aware of pledge in OpenBSD Chromium, it seems to me that in Linux Chromium implements a similar function leveraging seccomp-bfp and namespaces. - see chromium://sandbox on Linux -
    – puzzle
    Commented Aug 9, 2018 at 22:14
  • 2
    Yes, both are similar but you can't disable the sandbox on OpenBSD because the sandbox restrictions are part of the code of Chromium or Firefox. The OpenBSD developers are using the layers separation which both browsers include for Linux. Commented Aug 9, 2018 at 22:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .