MX Linux Forum

andyprough wrote: Fri Dec 06, 2019 9:37 am Couldn't you just

Code: Select all

firejail chromium

??

Just wondering. This how-to looks intriguing, but I'd rather have the functionality of firejail to sandbox numerous apps.

Edit: Sorry, I forgot this is dealing with the whole problem of chromium not starting because of the sandbox issue. Never mind - this is not an issue for firejail I guess.

BIN=chromium; firejail --dns=2606:4700:4700::1111 --dns=2606:4700:4700::1001 --dns=1.1.1.1 --dns=1.0.0.1 --profile=$BIN-browser --name=$BIN --join-or-start=$BIN chromium

andyprough wrote: Fri Dec 06, 2019 9:37 am Edit: Sorry, I forgot this is dealing with the whole problem of chromium not starting because of the sandbox issue. Never mind - this is not an issue for firejail I guess.

K-mik@Z wrote: Fri Dec 06, 2019 10:02 am I'm using firejail too, this does not preclude good sandboxing.

Code: Select all

BIN=chromium; firejail --dns=2606:4700:4700::1111 --dns=2606:4700:4700::1001 --dns=1.1.1.1 --dns=1.0.0.1 --profile=$BIN-browser --name=$BIN --join-or-start=$BIN chromium

andyprough wrote: Fri Dec 06, 2019 10:24 am If you get time, and it's not too much trouble to do in English (or French is fine, I can use a translator) - could you give a description of what you are doing with this command? What are the four different dns servers that you are pointing to here? They look like they are all Cloudflare related. Is Cloudflare the safest dns servers? I'm not familiar with Cloudflare dns servers

andyprough wrote: Fri Dec 06, 2019 10:24 am what is your criteria for choosing these four?

• Improves your Internet speed and page load-time

• Stabilizes your connection

• Provides greater online security and privacy

• Removes geo-restrictions

Stevo wrote: Fri Dec 06, 2019 4:09 pm Seems to be OK on the Liquorix kernel without any tweaks necessary:

Code: Select all

Sandbox Status
Layer 1 Sandbox	Namespace
PID namespaces	Yes
Network namespaces	Yes
Seccomp-BPF sandbox	Yes
Seccomp-BPF sandbox supports TSYNC	Yes
Ptrace Protection with Yama LSM (Broker)	Yes
Ptrace Protection with Yama LSM (Non-broker)	No
You are adequately sandboxed.

sudo setcap cap_sys_ptrace=eip /usr/bin/chromium

• e: Effective - This indicates that the capability is "activated."

• p: Permitted - This indicates that the capability can be used.

• i: Inherited - This indicates that the capability is inherited by child elements/subprocesses and defines which capabilities stay permitted across an exec().

K-mik@Z wrote: Fri Dec 06, 2019 9:19 am A trick is given everywhere on the web, set kernel.unprivileged_userns_clone = 1.

DO NOT SET kernel.unprivileged_userns_clone = 1. NEVER.

Copy and paste this into your terminal:

Code: Select all

cat /etc/sysctl.d/*.conf /etc/sysctl.conf | sudo sysctl -e -p -

If you see a line contains kernel.unprivileged_userns_clone = 1, please remove it, for security reason.
( Search in those file /etc/sysctl.d/*.conf, /etc/sysctl.conf )

Buck Fankers wrote: Sat Dec 07, 2019 9:37 am Thanks for sharing, I wouldn't have a clue where to look for it!

grep -H 'kernel.yama.ptrace_scope' /etc/sysctl.{c*,d/*}

grep -H 'kernel.unprivileged_userns_clone' /etc/sysctl.{c*,d/*}

Buck Fankers wrote: Sat Dec 07, 2019 9:37 am Thanks for sharing, I wouldn't have a clue where to look for it!

K-mik@Z wrote: Sat Dec 07, 2019 5:01 pm

Code: Select all

grep -H 'kernel.unprivileged_userns_clone' /etc/sysctl.{c*,d/*}

can give you the config file (/etc/sysctl.conf or one of /etc/sysctl.d/*.conf) and the parameters (if exist)