Hacker News Reader

Comment by miduil | Hacker News Reader

Last year, afer a firejail local root exploit got released [0], I've completely quit following their project.

I don't want to discomfort the developers and I think it's stunning what they are creating...

But under the aspect that they are working on a security product, I'm concerned by their overall code quality and testing strategy.

They might want to consider taking a step back and reevaluating how they are going to direct their development in terms of secure (c-)coding practices.

*Disclaimer: Not a developer, just a sysadmin, but reviewing some of their code/profiles/CI-jobs in their git repo [1] leaves a bad feeling.

[0]: https://www.exploit-db.com/exploits/43359/ [1]: https://github.com/netblue30/firejail/tree/6830065197cc57489...

View on HN

I didn't like the code either. I remember seeing that they were changing euid betwen root and something else all over the place, for seemingly little benfit, because exploit code could simply change it back to root too. It seemed a bit confused.

Though there's nsjail if you want something better written/cleaner.

Good to read about that you're feeling similar and thank you for the pointer, going to check it out.

Sadly this thread never gained traction, but I'd love to read more discussion about this: https://news.ycombinator.com/item?id=13838596

(Link for convenience for others) https://github.com/google/nsjail

>Last year, afer a firejail local root exploit got released

Is it worse than running Firefox without firejail?

Well it depends, does your Linux account running Firefox has the possibility to access root (sudo, su)?

If yes, I don't know. Maybe a 'strong' apparmor/selinux policy might capture some exploits, firejail tries to mitigate?

Other yes, clearly: A Firefox exploit would usually not result in root access (unless it's combined with other Linux exploits) - in the case of firejail, it would have resulted in a root exploit.

I'm not saying: Don't use firejail at any cost. But I'm trying to say that you shouldn't have a false confidence in your security, just because you are using firejail and this because their current practices doesn't seem ideal for a security product. At the moment firejail advocates sound like that firejail is 'a proper security solution for Linux desktop', but given the circumstances, it's not.

might be worth checking out tor-browser-(bundle?) apparmor profile/s

I have much the same story/experience. Do you use something else in place of firejail?

No, I'm still one part of the please don't hack me fraction - still I'm avoiding solution that might improve the security (when seen as layers) a bit.

I suppose one should use https://www.qubes-os.org/.

Qubes seems good, of course, but I've still been looking for less extreme measures.

Reply on news.ycombinator.com