Mastering Linux Security and Hardening - Second Edition

Sandboxing with Firejail

Firejail uses namespaces, SECCOMP, and kernel capabilities to run untrusted applications in their own individual sandboxes. This can help prevent data leakage between applications, and it can help prevent malicious programs from damaging your system. It's in the normal repositories for Debian and its offspring, which include Raspbian for Raspberry Pi devices and probably every member of the Ubuntu family. On the Red Hat side, it's in the Fedora repositories, but not in the CentOS repositories. So, for CentOS, you'd have to download the source code and compile it locally. Firejail is meant for use on single-user desktop systems, so we'll need to use a desktop version of Linux. To make things easy, I'll use Lubuntu, ...