0

In my testing of Fedora 29 and came to find it uses SELinux by default; I installed firejail which is available in the repos. Is there any benefit to running Firejail within this environment or is it redundant and or potentially opening the O/S to even more attack vectors?

1

To be clear this question is more of an opinion then a hard fact.

Selinux and Firejail preform sandboxing by separate mean. SeLinux at its core is a advances access control list (using Labels), while Firejail make use Seccomp and Linux Namespaces (https://firejail.wordpress.com/).

Yes, installing setuid program do alway have a danger and since you already have selinux, it many not provide more benefit. Though not all programs have their own selinux profile and firejail could offer more options in this case.

In security there is a concept of belt and suspenders approach to add extra protection where possible. Your home had lock on the doors and windows, do you still use and alarm?

SeLinux is relatively hard to configure, compared to firejail. Though, FireJail is not an alway on option like selinux.

$ firejail firefox                       # starting Mozilla Firefox
$ firejail transmission-gtk              # starting Transmission BitTorrent 
$ firejail vlc                           # starting VideoLAN Client
$ sudo firejail /etc/init.d/nginx start  # starting nginx web server

If I have to choose one, I would definitely choose SELINUX as it is built into the Distro and comes preconfigured.

If you are very concerned about the suid, you may want to consider mbox (https://pdos.csail.mit.edu/archive/mbox/) though I cannot speak to its quality or if it is maintained.

  • YES I am seeing Fedora does by default provide selinux hardening profiles for Chrome & Firefox. This was what I was concerned about. The list is available via: sudo semanage fcontext -l |grep * Rules look incredibly simplistic for firefox and chrome. Leaves me wondering if I need to do more. I'm impressed with the quantity of rules that exist for a wide variety of applications. I also love Fedoras package manager. Being able to install multiple packages at once, though it is slow in VirtualBox, I will seek a lighter version. Thank you Anthony T! You answered the question absolutely perfectly! – Tyler Feb 28 at 12:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.