I appreciate your reply!
Seeing that it’s using a Wordpress domain makes it seem really amateurish…
Why do you prefer firejail over something like bubblejail? Is it because there are more profiles?
I have three years worth of commits in Firejail before bubblejail even existed.
3 Likes
I’m not knowledgeable enough to discuss this properly, but could you please elaborate a little more?
I trust your input and experience as a well-regarded member of the community. I’ve been planning to start using Firejail.
However, a few places I consulted described Firejail as having some design flaws compared to Bubblejail. It sounds like Firejail has more profiles and advanced security options, but Bubblejail is presented as a less risky tool for everyday use because it has zero setuid binaries (Firejail CVE-2022-31214), which eliminates the chance for unprivileged users to create namespaces and escalate privileges to root.
Should we ignore the risk? Is it a light risk and the benefits of Firejail outrun Bubblejail?
Regardless if Bubblejail is more secure, it still lacks the hundreds of profiles that Firejail has.
An approach like GitHub - roddhjav/apparmor.d: Full set of AppArmor policies is probably better than both to an extent.
There are infinite number of applications meaning adding a new profile for each one of them is infeasible.
See firejail’s profile folders which had to be alphabetically split in to 2 because of number of profiles: https://github.com/netblue30/firejail/tree/master/etc
Instead of trying to add more and more profiles why not automate the sandboxing configuration by record data while running a new sandbox.
The workflow would be: user creates new sandbox → sandbox is started with data recording → sandboxed application either crashes or is closed → user is prompted with settings recommendations based on collected data → sandbox is run again until sandbox configuration is satisfactory → instance switches data recording off for performance
What do you think about this kind of approach?
I was thinking the same thing you wrote, because secureblue explicitly says to avoid it and use Bubblejail instead, and one of the GrapheneOS devs also said to avoid using firejail.