1

I am increasingly being requested to join videoconferences through Zoom, which I don't trust to run on my machine. I understand that there are two common ways of sandboxing this software: you can either download the standalone Zoom application and then run it with the aid of some access control system, such as Firejail or AppArmor, or you can join the videoconference via Chromium, which will prompt the browser to download and run Zoom in its own sandboxed environment.

Another question here addresses the difference between Firejail and AppArmor (for the general case, not just for Zoom). But what are the differences between running an application in a Firejail sandbox versus running it in a Chromium sandbox? Using Chromium seems to be more convenient, since it doesn't require the user to separately download and install an access control system and the standalone application. But are there any differences from a security point of view? Do Chromium-sandboxed applications have access to any parts of one's system that Firejail-sandboxed applications do not, or vice versa? Are there any other advantages or disadvantages to consider?

(Note that although this question arose from pressure to use Zoom, I'm really interested in the more general issue of how Firejail and Chromium differ in their approach to sandboxing. I understand that the standalone Zoom application may differ in behaviour from the browser-based version that Chromium runs and so answers need not necessarily address any security risks specific to Zoom.)

Improve this question
4
  • in addition to sandboxing, I'd suggest turning off support for remote accesss/control at the OS level. (if you ever want to use it, turn it on for that session and then turn it off again.)
    – pcalkins
    Sep 10, 2021 at 20:09
  • @pcalkins: I'm afraid I don't understand what you are talking about. What do you mean exactly by "support for remote access/control" and by "session"?
    – Psychonaut
    Sep 10, 2021 at 20:38
  • For Mac: support.apple.com/guide/remote-desktop/… For Windows: securicy.com/blog/how-to-disable-remote-access-in-windows-10 (By session I mean just for the time period that the feature is in use.)
    – pcalkins
    Sep 10, 2021 at 20:55
  • That seems rather like a security tip of a general nature, and not one that addresses my question. (And in any event, it doesn't make sense for a multiuser system where remote users need to be able to connect at any time—e.g., I can't disable sshd on the computer I run Zoom on because other people might need to log in.)
    – Psychonaut
    Sep 11, 2021 at 6:00

1 Answer 1

Reset to default
0

The browsers do not allow web applications to directly access the filesystem. They can only:

  • Ask the user to upload a file of their choosing.
  • Start downloading a file that will be safe in the directory chosen by the user (by default the "Downloads" directory).

Installed applications can have a full access to the filesystem.

On top of that, further restrictions can be added by Firejail or Apparmor to limit the access to the filesystem (among other resources). Those restriction can be applied to any applications, including browsers. So instead of choosing between a Chromium sandbox and a Firejail sandbox, you can use both.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .