1

I'd like to understand how Apparmor and Firejail compare to each other: advantages, pros and cons, purposes, similarities, etc.

I might be asking to compare apples with oranges, however I've noticed several similarities. Firejail has "profiles", and they contain a list of rules that allow you to define what files an application can use. Apparmor lets you do the same, more or less. However Firejail also lets you define "capabilities", and apparently it tries to isolate the process even if it ever gains root privileges (like it is in a container?). Anyway, I can spot some similarities but I don't know either of them well enough to understand all their features and purposes.

2

AppArmor could be closer compared to SELinux than FireJail, but here's the differences.

The most important (IMO) is the level at which they run. FireJail runs as a program in userspace while AppArmor runs at the kernel level.

FireJail takes advantage of Linux namespaces to provide isolation on a user, mount, network, and process level. This isolation provides the application it's own sandbox to do whatever it wants in while preventing those changes from effecting the rest of the system. You can think of this being similar to a container like you said. Containers also use namespaces for isolation.

By contrast, AppArmor doesn't provide sandboxing, rather it limits what parts of the system the application can access. You're specifying specific resources an app cannot use. These resources are not isolated though, so two apps running with AppArmor with access to the same resource could interact.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.