2

In my testing of Fedora 29 and came to find it uses SELinux by default; I installed firejail which is available in the repos. Is there any benefit to running Firejail within this environment or is it redundant and or potentially opening the O/S to even more attack vectors?

1 Answer 1

4

To be clear, this question is more of an opinion than a hard fact.

SELinux and Firejail perform sandboxing by separate means. At its core, SELinux is an advanced access control list (using Labels), while Firejail uses Seccomp and Linux Namespaces (https://firejail.wordpress.com/).

Yes, installing setuid program does always have a danger, and since you already have SELinux, it may not provide more benefit. Though not all programs have their own SELinux profile, and fireJail could offer more options in this case.

In security, there is a concept of belt and suspenders approach to add extra protection where possible. Your home had a lock on the doors and windows, do you still use an alarm?

SELinux is relatively hard to configure, compared to fireJail. Though FireJail is not an always-on option like SELinux.

$ firejail firefox                       # starting Mozilla Firefox
$ firejail transmission-gtk              # starting Transmission BitTorrent 
$ firejail vlc                           # starting VideoLAN Client
$ sudo firejail /etc/init.d/nginx start  # starting nginx web server

If I have to choose one, I would definitely choose SELINUX as it is built into the Distro and comes preconfigured.

If you are very concerned about the suid, you may want to consider mbox (https://pdos.csail.mit.edu/archive/mbox/) though I cannot speak to its quality or if it is maintained.

Update

Reviewing the text above and as my usage of fireJail has increased. There are definitely advantages to using fireJail. AppArmor and SELinux are more concerned about protecting systems from applications. Many Application profiles will not provide as much isolation for the user.

On Normal firefox, it can see most of the user's home directory. Under FireJail profile, that is more limited to Download, firefox, and .cache, and so on.

Additionally, Mbox does not seem updated in a number of years. It likely should not be used.

1
  • 1
    YES I am seeing Fedora does by default provide selinux hardening profiles for Chrome & Firefox. This was what I was concerned about. The list is available via: sudo semanage fcontext -l |grep * Rules look incredibly simplistic for firefox and chrome. Leaves me wondering if I need to do more. I'm impressed with the quantity of rules that exist for a wide variety of applications. I also love Fedoras package manager. Being able to install multiple packages at once, though it is slow in VirtualBox, I will seek a lighter version. Thank you Anthony T! You answered the question absolutely perfectly!
    – Tyler
    Feb 28, 2019 at 12:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .