Sandboxing apps

1 Firejail

archlinux says

Firejail is an easy-to-use SUID sandbox program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces, seccomp-bpf and Linux capabilities.

nachoparker’s intro is comprehensible.

2 Bubblewrap

Abstracted from the app standard Flatpak is bubblewrap.

Many container runtime tools like systemd-nspawn, docker, etc. focus on providing infrastructure for system administrators and orchestration tools (e.g. Kubernetes) to run containers.

These tools are not suitable to give to unprivileged users, because it is trivial to turn such access into a fully privileged root shell on the host.

Rumour has it that bubblewrap is more secure than Firejail because it deliberately does less: by design bubblewrap does not try to cover every scenario, so out of the box it does not bridge PulseAudio, X11, or DBus into the sandbox for us. Essentially there is a trade-off in modern architectures, between fun interactive multimedia and doing things securely.

Where Firejail ships profiles that guess what an app needs, bubblewrap makes us assemble the sandbox’s filesystem by hand, one bind mount at a time. A throwaway shell with a read-only system, no network and a private /tmp:

bwrap \
  --ro-bind /usr /usr \
  --symlink usr/lib /lib \
  --symlink usr/lib64 /lib64 \
  --symlink usr/bin /bin \
  --ro-bind /etc /etc \
  --proc /proc \
  --dev /dev \
  --tmpfs /tmp \
  --unshare-all \
  --die-with-parent \
  bash

The process sees only what we mounted: --unshare-all severs every namespace, the network among them; --tmpfs /tmp gives it a /tmp that evaporates when the shell exits; and there is no /home — nor any audio socket — unless we bind one in ourselves.

Notably Flatpak apps do support audio. Binding that socket in is what Flatpak does for us. This didn’t work great for a while because linux audio is a shitnado, but the desktop is moving to PipeWire, which is a more sane design and easier to configure for a sandbox.

3 Apparmor

AppArmor, the ACL system preferred by Ubuntu is another way to build sandboxes for apps, in that it controls access to resources for processes. It’s probably a good way to do things, but the documentation is not accessible or comprehensible to normal schmucks like me. The Ubuntu community wiki is as close as it gets to a manual that one can read online AFAICT.

4 Seatbelt

macOS ships its own sandbox, Seatbelt, implemented as a “TrustedBSD mandatory-access-control module” at the kernel level. There is a user-facing wrapper, sandbox-exec, which executes an arbitrary command under a supplied policy.

A policy is a TinyScheme program — wherein we do stuff like (deny foo) and then (allow bar) back the operations the program is actually permitted to touch: file-read*, file-write*, network*, process-exec, mach-lookup and friends. We can pass the profile inline with -p, or keep it in a .sb file passed -f.

Running something with no network at all:

sandbox-exec -p '(version 1)(allow default)(deny network*)' \
  curl https://example.com
# curl: (6) Could not resolve host: example.com

Or the more paranoid deny-everything-then-allow-back stance favoured by Apple itself:

sandbox-exec -p '(version 1)
  (deny default)
  (allow process-exec)
  (allow file-read*)
  (deny file-read* (subpath "/Users"))' \
  some-sketchy-binary

As with other sandboxing systems, there is a trade-off between security and convenience.

A peculiar thing about Seatbelt is that sandbox-exec has been deprecated since about 2017 — its own man page opens with the word DEPRECATED in capitals — and yet it is everywhere and the whole operating system leans on the same machinery.¹

The supported replacement is the App Sandbox, which uses the same kernel mechanism but less dynamically (i.e. more AppArmor-like) — entitlements are baked into a code-signed app rather than a scheme file.

Chromium uses Seatbelt to lock down its renderer processes. Lately the technique has found a second audience among people scrambling to wrap AI agents and exploit-heavy apps like npm.