Hacker News Reader

Looks interesting but what I don’t understand is if it really is sandboxed, how would a Firefox know that there is another Firefox running and open a tab there (as per the FAQ) instead of a new Firefox in a different sandbox?

View on HN

The "sandboxing", as I understand it, only applies to the filesystem; processes can still see other processes run in different firejails if they are being run by the same user.

Sure you could see them, after all you can do a ps and see all processes, but shouldn’t the IPC between firejails be forbidden? How is firejail 2 talking to firejail 1?

> ... after all you can do a ps and see all processes ...

Which you can prevent by mounting /proc with the "hidepid" option.

> shouldn’t the IPC between firejails be forbidden?

I think it depends on what kind of IPC. I'm not familiar enough with the details of how Firefox does it to know how that would interact with firejails.

Unless not possible due to requirements of a specific program, firejails have their own PID namespace and can only see themselves.

It is because of user namespaces. I assume you can tell firejail to use seperate ones with some commandline switches.

Reply on news.ycombinator.com