Hacker News Reader

Firejail can easily suffer from some of the same issues, if it's not configured properly. Some of the issues listed here are not specific to Flatpak, and need to be addressed with any sandboxing mechanism.

View on HN

Firejail is a tool, and a pretty nice one. But it isn't simple to use yet. But with support for using overlay filesystems for home or root, combined with cgroups isolation and it covers the issues that site brings up.

Flatpak handles all that too, all these tools are using the same Linux security primitives. There is really not any difference between them from a security perspective. Technically flatpak is based around bubblewrap for some of the low level bits, which is kind of like an even simpler version of firejail: https://github.com/containers/bubblewrap

I’ve read a security researcher’s option on firejail - that it is problematic as it is a suid executable. Making a potential bug into a root exploit.

Could someone verify/disprove this? I would guess it drops privileges as soon as they are not needed but didn’t yet have the time to look at it and I have no sufficient knowledge to say whether privilege dropping is enough.

It really depends on what you're trying to do. Doing some things on some distros is still not possible without having the setuid bit.

Reply on news.ycombinator.com