Running your programs in a jail with Firejail
The Jailer

Firejail enhances security by isolating programs and processes in separate jails and thus regulating access to the filesystem.
Malware frequently exploits vulnerabilities in the browser or background services. After breaking in, malicious programs manipulate configuration files, install rootkits, or exploit other programs. A software tool called Firejail prevents malware from taking over by locking away Firefox, Apache, or any other endangered program in a jail.
In this isolated jail, which is also called a sandbox, a program that has been compromised by malware won't be able to manipulate any important files and can only run wild in the confines of its own walls. If so desired, Firejail will regulate and manage the view of the filesystem and discard any files created by the programs. Unlike a virtual machine, which emulates a complete PC, the GUI and server applications, as well as demanding games with 3D acceleration, run at full power in the Firejail sandbox.
Building a Jail
On the Firejail homepage, you can get prebuilt packages for popular distributions: Debian, Ubuntu, Linux Mint, Fedora, openSUSE, CentOS 7, and RHEL 7 [1]. All of these packages require a 64-bit system. Arch Linux users will find Firejail in the AUR; packages for Slackware are available from the SlackBuilds repository [2].
If you can't find a matching package for your distribution, you need to turn to the source code archive. After unpacking the archive, you only need to run the following command line:
./configure && make && sudo make install
For the build and installation to start, you need make
, a C compiler, and the kernel headers. Firejail works with all kernels from the 3.x series; however, there are a few functions that you can only use if you have a newer kernel version (more on this subject later).
To lock an application up in jail, you need to call firejail
with the name of the program you want to launch. To run Firefox in a jail, you would type:
firejail firefox
If the program you are locking away additionally needs parameters, you simply append them. If you simply call firejail
without any parameters, you get a sandbox with a Bash shell, as shown in Figure 1. In contrast to what the official documentation says [3], Firejail keeps running in the background until the program in the sandbox terminates.

A minor stumbling hazard for web servers, databases, and other services is that their daemons immediately disappear into the background when launched. Firejail then believes that the program was terminated and takes down the sandbox and the service with it. To prevent this from happening, you need to resort to the following trick:
firejail "/etc/init.d/sshd start && sleep inf"
to keep Firejail waiting, or running, infinitely after starting the daemon.
Extremely Forgetful
The programs in the sandbox have only read access to all directories and are thus unable to manipulate any important files. However, the directories /home
, /tmp
, and /var
remain writable (Figure 2).

If these restrictions do not suit your purposes, you can enable what is known as an overlay filesystem. The technology behind this is also used on Live systems: Firejail lets the program in the sandbox think that it can manipulate the filesystem to its heart's desire. Instead, Firejail actually intercepts any changes and even discards them when the sandbox terminates. This means that your hard disk remains totally unchanged. From a technical point of view, Firejail overlays a filesystem on top of the existing one (see the "Internals" box for details).
Internals
Firejail relies on Linux kernel namespaces to create sandboxes. In doing so, Firejail tricks processes into believing that they are running entirely on their own on the system. Additionally, the tool uses namespaces to regulate access to the network and the filesystem.
Firejail also creates its own network stack in the sandbox. The sandbox thus has its own routing table, its own netfilter or iptables firewalls, and its own network interfaces. Firejail implements the overlay filesystem with the help of OverlayFS [5]. New or modified files end up in a separate filesystem, which overlays the existing filesystem. Private mode follows a similar principle: If enabled, Firejail mounts a tempfs
filesystem on top of the home directory.
As the --seccomp
and --caps
parameters suggest, Firejail uses the kernel's seccomp support or turns to Linux Capabilities [6]. Experts can list additional syscalls after --seccomp
that they want Firejail to block in the sandbox, for example:
firejail --seccomp=chmod,fchmod,fchmodat
For deeper insights into the workings of the jailed processes, try the firemon
tool. It lets you monitor all of the fork
, exec
, ID change, and exit
events in the sandbox and log these activities if needed. The firemon
tool needs root privileges to do this. To discover which processes the open
, unlink
, mkdir
, rmdir
, stat
, access
, socket
, connect
, and bind
functions call in glibc
, try launching firejail
with the --trace
parameter:
firejail --trace firefox
If you want to use the overlay filesystem, simply append the --overlay
option to the firejail
command line:
firejail --overlay gedit
After starting Gedit in this way, you can create and modify files. After terminating Gedit, all the new files disappear into a black hole, while the modified files continue to exist unchanged on your hard disk. The overlay filesystem is useful for browsers in particular: It means that any cookies you collect, the browser history, and the cache are deleted when you terminate the browser. The --overlay
option needs a Linux kernel as of version 3.18, although some distributions enabled this feature some time ago, including Ubuntu and openSUSE.
Privacy
Firejail can switch the sandbox to Private mode. In this case, the sandbox hides the complete home directory specifically from the active programs. They only see empty /root
and /home
directories. Firejail discards any files written to these directories after terminating the sandbox. You can enable Private mode using the --private
parameter:
firejail --private firefox
Instead of /root
and /home
, you can pass in any other directory to the sandbox. In this case, files created by the program are kept, although they will never reach the genuine /root
and /home
directories, but always end up in the substitute directories that you specify. In the example
firejail --private=~/junk firefox
Firefox would see the contents of the ~/junk
directory as its home directory while running in the sandbox (Figure 3).

Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you've found an article to be beneficial.
News
-
2024 Open Source Professionals Job Survey Now Open
Share your expectations regarding open source jobs.
-
Arch Linux 2023.12.01 Released with a Much-Improved Installer
If you've ever wanted to install Arch Linux, now is your time. With the latest release, the archinstall script vastly simplifies the process.
-
Zorin OS 17 Beta Available for Testing
The upcoming version of Zorin OS includes plenty of improvements to take your PC to a whole new level of user-friendliness.
-
Red Hat Migrates RHEL from Xorg to Wayland
If you've been wondering when Xorg will finally be a thing of the past, wonder no more, as Red Hat has made it clear.
-
PipeWire 1.0 Officially Released
PipeWire was created to take the place of the oft-troubled PulseAudio and has finally reached the 1.0 status as a major update with plenty of improvements and the usual bug fixes.
-
Rocky Linux 9.3 Available for Download
The latest version of the RHEL alternative is now available and brings back cloud and container images for ppc64le along with plenty of new features and fixes.
-
Ubuntu Budgie Shifts How to Tackle Wayland
Ubuntu Budgie has yet to make the switch to Wayland but with a change in approaches, they're finally on track to making it happen.
-
TUXEDO's New Ultraportable Linux Workstation Released
The TUXEDO Pulse 14 blends portability with power, thanks to the AMD Ryzen 7 7840HS CPU.
-
AlmaLinux Will No Longer Be "Just Another RHEL Clone"
With the release of AlmaLinux 9.3, the distribution will be built entirely from upstream sources.
-
elementary OS 8 Has a Big Surprise in Store
When elementary OS 8 finally arrives, it will not only be based on Ubuntu 24.04 but it will also default to Wayland for better performance and security.