Reply to thread

Message

<blockquote data-quote="Victor M" data-source="post: 1109260" data-attributes="member: 96560">firejail does it better. You can use the firefox-common.profile of the Fortified Ubuntu 24.04 hardening.PDF on fortifiedubuntu.org.&nbsp; The profile mentions apparmor, but it will work without it.&nbsp; For example while the SELinux allows firefox to see the whole /etc directory, firejail only allows it to see a limited subset of files. There are many restrictions laid down in that firefox-common.profile.There should be some additional restrictions when you make your Fedora user account use the user_u SELinux user. But I didn&#039;t really investigate. One restriction I know exists for user_u is that that account couldn&#039;t sudo. I think SELinux defines 3 kinds of users, and user_u is the lowest ranking one. There is a xguest SELinux user which you should get if you install the xguest package, but that doesn&#039;t work on Fedora 40 - the installed Guest account can&#039;t login, perhaps it only works in Red Hat.[EDIT]&nbsp; If you implement user_u, firejail will say there is an existing sandbox and run your program Without any firejail protection.</blockquote>

[QUOTE="Victor M, post: 1109260, member: 96560"] firejail does it better. You can use the firefox-common.profile of the Fortified Ubuntu 24.04 hardening.PDF on fortifiedubuntu.org. The profile mentions apparmor, but it will work without it. For example while the SELinux allows firefox to see the whole /etc directory, firejail only allows it to see a limited subset of files. There are many restrictions laid down in that firefox-common.profile. There should be some additional restrictions when you make your Fedora user account use the user_u SELinux user. But I didn't really investigate. One restriction I know exists for user_u is that that account couldn't sudo. I think SELinux defines 3 kinds of users, and user_u is the lowest ranking one. There is a xguest SELinux user which you should get if you install the xguest package, but that doesn't work on Fedora 40 - the installed Guest account can't login, perhaps it only works in Red Hat. [EDIT] If you implement user_u, firejail will say there is an existing sandbox and run your program Without any firejail protection. [/QUOTE]

Verification