Arch Linux

alsr

Member

Registered: 2020-04-25

Posts: 7

A couple of questions about firejail

Hi,

According to the homepage of the sadly defunct software mbox, it is a program that does exactly what I'm looking for:

"Mbox introduces a novel sandbox usage model; when executing a program in the sandbox, Mbox prevents programs from modifying the host filesystem while giving them the impression that they are in fact making those modifications. Mbox achieves this by providing a layered sandbox filesystem and by interposing on system calls with ptrace and seccomp/BPF. At the end of program execution, the user can examine changes in the sandbox filesystem, and selectively commit them back to the host filesystem."

My first question is: how could I emulate this behavior in firejail?

My second question is: can you foresee anything going wrong if I were to install a program into a superimposed sandbox environment? I mean, can you nest processes with firejail? If I was to, say,

firejail bash
pacman -S gnumeric
gnumeric

...and then, let's say, enter data to a spreadsheet, then save it through the save-file dialogue, would all of that remain within the sandboxed filesystem layer so that if you nuked the whole sandbox, then the saved spreadsheet along with the installed program would all disappear?

TIA

[1] https://pdos.csail.mit.edu/archive/mbox … king-about