You are not logged in.
Pages: 1
Ok,
So I've read the guide and I know you can do this in Firejail. However there's something I'm still not quite getting as I'm wanting to actually launch the x server in firejail from the login manager on startup (currently using rootless xorg on SDDM). The guides and sites I can see talk about Xephyr which I already have installed (though not sure yet how to configure) and also sandboxing individual programs, but nothing I can find seems to suggest it's possible to actually sandbox Xorg/x11 as a whole. I want to arrange this so when I click programs they just work and have all the security in place so keyloggers etc can't be used and they can't talk to one another. I don't really want them all under separate X11 servers but combined as they are now.
Is what I'm looking for actually possible? I can't move to Wayland as I need historic X11 support for old games and it's not stable enough.
Also this may be more of a question for Firejail rather than here, but has anyone managed to ensure that programs launched can only be ran through Firejail? I know you can change all the desktop shortcuts etc which I've already done, however I don't like the fact that programs still stay on the machine wherever they are typically installed and you're running "/usr/bin/firejail /usr/bin/xyz" for instance. It seems like a big loophole and I want to close it.
Any advice/assistance would be appreciated as this is probably the one thing/area that's holding me back now.
Last edited by Chris98 (2023-01-21 16:41:47)
Offline
Hello! There is a thing called XWayland, it's a server for X apps on Wayland. Basically, only XWayland apps can log other XWayland apps and your other stuff running on Wayland is safe. Unless you care for some malicious app to log what you're doing in the old videogames you mentioned. This seems like the perfect solution for you as sandboxing X does require to run separate servers for each application (X by design doesn't do anything about keystroke logging and the only option to circumvent that is to run nested X servers).
As for the other part of your post, what you're looking for is SELinux or AppArmor, not Firejail. Tools like flatpak, snap and firejail were made to be "wrapped" around existing applications, so if that loophole, as you call it is a big issue for you, then get AppArmor/SELinux and make profiles for your apps. But, in my humble opinion, it's not really a problem if you contain most apps with Firejail and deny them access to paths where binaries are located
Offline
Ok,
So I've read the guide and I know you can do this in Firejail. However there's something I'm still not quite getting as I'm wanting to actually launch the x server in firejail from the login manager on startup (currently using rootless xorg on SDDM). The guides and sites I can see talk about Xephyr which I already have installed (though not sure yet how to configure) and also sandboxing individual programs, but nothing I can find seems to suggest it's possible to actually sandbox Xorg/x11 as a whole. I want to arrange this so when I click programs they just work and have all the security in place so keyloggers etc can't be used and they can't talk to one another. I don't really want them all under separate X11 servers but combined as they are now.
Is what I'm looking for actually possible? I can't move to Wayland as I need historic X11 support for old games and it's not stable enough.
Also this may be more of a question for Firejail rather than here, but has anyone managed to ensure that programs launched can only be ran through Firejail? I know you can change all the desktop shortcuts etc which I've already done, however I don't like the fact that programs still stay on the machine wherever they are typically installed and you're running "/usr/bin/firejail /usr/bin/xyz" for instance. It seems like a big loophole and I want to close it.
Any advice/assistance would be appreciated as this is probably the one thing/area that's holding me back now.
?
firejail --help # -> Examples:
Last edited by growler (2023-02-18 08:03:06)
Offline
Pages: 1