Arch Linux

IrvineHimself

Member

From: Scotland

Registered: 2016-08-21

Posts: 275

[solved] Firejail sandbox on top of MAC's?

A kind of general question about what would happen if a malicious website, (or application,) was to break out of the browser's Firejail sandbox  when the browser was separately confined by either a SELinux policy or an Apparmor profile?

Would the attack still be confined by the MAC, or would it now have free reign of the system? More specifically, does the combination of sandbox and MAC offer a double layer of protection?

Thanks for your thoughts
Irvine

Last edited by IrvineHimself (2018-05-05 21:49:36)

---

Et voilà, elle arrive. La pièce, le sous, peut-être qu'il arrive avec vous!

twelveeighty

Member

Registered: 2011-09-04

Posts: 1,456

Re: [solved] Firejail sandbox on top of MAC's?

These types of questions tend to lead to bike-shedding really quickly, since this all depends on what the attack is targeting. Can a Web page or application trick an unsuspecting user into downloading and executing something malicious themselves?

loqs

Member

Registered: 2014-03-06

Posts: 19,113

Re: [solved] Firejail sandbox on top of MAC's?

That executable should still be restricted by the SE linux policy for either the interpreter or the policy for an executable with no security attributes should it not?
That is also somewhat different from escaping the sandbox but still having the security attributes of the original executable.
I suspect as arch does not use SE linux or firejail by default the number of users with knowledge of combining both and who post to the forums could be very small to none.

IrvineHimself

Member

From: Scotland

Registered: 2016-08-21

Posts: 275

Re: [solved] Firejail sandbox on top of MAC's?

These types of questions tend to lead to bike-shedding really quickly, .....

.....I suspect as arch does not use SE linux or firejail by default the number of users with knowledge of combining both and who post to the forums could be very small to none.

Both points well noted and I am going to mark this as solved.

That executable should still be restricted by the SE linux policy for either the interpreter or the policy for an executable with no security attributes should it not? .....

I find this to be extremely stimulating.... Because of the difference in the way Apparmor and SELinux work, I think this at least partially answers my question and opens a host of others that, if aired on these boards, would indeed quickly lead to "bike shedding".

Irvine

---

Et voilà, elle arrive. La pièce, le sous, peut-être qu'il arrive avec vous!

Everette88

Member

Registered: 2018-02-17

Posts: 41

Re: [solved] Firejail sandbox on top of MAC's?

MAC(s) are enforced by linux kernel and are different layer of protection than userspace tools like fiejail or other sandboxes (and technically MAC is always "on top" not the other way around). Having a general MAC policy + using targeted firejail profile for some app make sense. If you have targeted MAC policy for specific app then using firejail will be redundant and can cause trouble for debugging (as AppArmor in official kernels is still nerfed you may prefer firejail in such case).

Last edited by Everette88 (2018-05-05 22:39:12)

IrvineHimself

Member

From: Scotland

Registered: 2016-08-21

Posts: 275

Re: [solved] Firejail sandbox on top of MAC's?

.....If you have targeted MAC policy for specific app then using firejail will be redundant and can cause trouble for debugging (as AppArmor in official kernels is still nerfed you may prefer firejail in such case).

Tell me about it

A couple of months ago, I finished a project to sandbox everything, and I mean everything, on my box. After a short rest, I have now started two new projects. In the afternoons I am working on getting my head around SELinux, while in the early mornings, I have started work on repeating the sandbox experiment with Apparmor. Forgetting to disable my Firejail symlinks before gathering data for aa-logprof can waste an entire morning, and, unless I wish to run without any security for a couple of months, using a Systemic profiling method  is completely out of the question.

Edit
A slightly pedantic point, but, everything else being equal, you can usually use the Firejail profile to enable seccomp in addition to the MAC policy/profile.

Edit2
After sleeping on it: If the MAC profile/policy is processed first, then Firejail's seccomp feature may never get a chance to kill the offending process. so the above edit may not be completely accurate. Once I get my Apparmor project further advanced, I may run some tests on this.

Irvine

Last edited by IrvineHimself (2018-05-06 04:53:00)

---

Et voilà, elle arrive. La pièce, le sous, peut-être qu'il arrive avec vous!