VnXrLgQg

1FIREJAIL(1)                    firejail man page                   FIREJAIL(1)
2
3NAME
4       Firejail - Linux namespaces sandbox program
5
6SYNOPSIS
7       Start a sandbox:
8
9              firejail [OPTIONS] [program and arguments]
10
11       File transfer from an existing sandbox
12
13              firejail {--ls | --get | --put} dir_or_filename
14
15       Network traffic shaping for an existing sandbox:
16
17              firejail --bandwidth={name|pid} bandwidth-command
18
19       Monitoring:
20
21              firejail {--list | --netstats | --top | --tree}
22
23       Miscellaneous:
24
25              firejail  {-? | --debug-caps | --debug-errnos | --debug-syscalls
26              | --debug-protocols | --help | --version}
27
28DESCRIPTION
29       Firejail is a SUID sandbox program that reduces the  risk  of  security
30       breaches  by  restricting the running environment of untrusted applica‐
31       tions using Linux namespaces, seccomp-bpf and Linux  capabilities.   It
32       allows a process and all its descendants to have their own private view
33       of the globally shared kernel resources, such  as  the  network  stack,
34       process table, mount table.  Firejail can work in a SELinux or AppArmor
35       environment, and it is integrated with Linux Control Groups.
36
37       Written in C with virtually no dependencies, the software runs  on  any
38       Linux  computer with a 3.x kernel version or newer.  It can sandbox any
39       type of processes: servers, graphical applications, and even user login
40       sessions.
41
42       Firejail  allows the user to manage application security using security
43       profiles.  Each profile defines a set of  permissions  for  a  specific
44       application  or  group  of applications. The software includes security
45       profiles for a number of more common Linux programs,  such  as  Mozilla
46       Firefox, Chromium, VLC, Transmission etc.
47
48USAGE
49       Without  any  options,  the sandbox consists of a filesystem build in a
50       new mount namespace, and new PID and UTS namespaces. IPC,  network  and
51       user  namespaces  can  be  added  using  the  command line options. The
52       default Firejail filesystem is based on the host  filesystem  with  the
53       main  system directories mounted read-only. These directories are /etc,
54       /var, /usr, /bin, /sbin, /lib, /lib32, /libx32 and /lib64.  Only  /home
55       and /tmp are writable.
56
57       As it starts up, Firejail tries to find a security profile based on the
58       name of the application.  If an appropriate profile is not found, Fire‐
59       jail will use a default profile.  The default profile is quite restric‐
60       tive. In case the application doesn't work, use --noprofile  option  to
61       disable  it. For more information, please see SECURITY PROFILES section
62       below.
63
64       If a program argument  is  not  specified,  Firejail  starts  /bin/bash
65       shell.  Examples:
66
67       $ firejail [OPTIONS]                # starting a /bin/bash shell
68
69       $ firejail [OPTIONS] firefox        # starting Mozilla Firefox
70
71       # sudo firejail [OPTIONS] /etc/init.d/nginx start
72
73OPTIONS
74       --     Signal  the  end of options and disables further option process‐
75              ing.
76
77       --allow-debuggers
78              Allow tools such  as  strace  and  gdb  inside  the  sandbox  by
79              whitelisting  system  calls  ptrace  and  process_vm_readv. This
80              option is only available when running on Linux  kernels  4.8  or
81              newer  - a kernel bug in ptrace system call allows a full bypass
82              of the seccomp filter.
83
84              Example:
85              $  firejail    --allow-debuggers   --profile=/etc/firejail/fire‐
86              fox.profile strace -f firefox
87
88       --allusers
89              All  directories  under /home are visible inside the sandbox. By
90              default, only current user home directory is visible.
91
92              Example:
93              $ firejail --allusers
94
95       --apparmor
96              Enable AppArmor confinement. For more  information,  please  see
97              APPARMOR section below.
98
99       --appimage
100              Sandbox an AppImage (https://appimage.org/) application.
101
102              Example:
103              $ firejail --appimage krita-3.0-x86_64.appimage
104              $ firejail --appimage --private krita-3.0-x86_64.appimage
105              $ firejail --appimage --net=none --x11 krita-3.0-x86_64.appimage
106
107       --audit
108              Audit the sandbox, see AUDIT section for more details.
109
110       --audit=test-program
111              Audit the sandbox, see AUDIT section for more details.
112
113       --bandwidth=name|pid
114              Set  bandwidth limits for the sandbox identified by name or PID,
115              see TRAFFIC SHAPING section for more details.
116
117       --bind=filename1,filename2
118              Mount-bind filename1 on top of filename2. This  option  is  only
119              available when running as root.
120
121              Example:
122              # firejail --bind=/config/etc/passwd,/etc/passwd
123
124       --blacklist=dirname_or_filename
125              Blacklist  directory  or  file.  File globbing is supported, see
126              FILE GLOBBING section for more details.
127
128              Example:
129              $ firejail --blacklist=/sbin --blacklist=/usr/sbin
130              $ firejail --blacklist=~/.mozilla
131              $ firejail "--blacklist=/home/username/My Virtual Machines"
132              $ firejail --blacklist=/home/username/My Virtual Machines
133
134       --build
135              The command builds a whitelisted profile. The profile is printed
136              on the screen. If /usr/bin/strace is installed on the system, it
137              also builds a whitelisted seccomp profile. The program is run in
138              a  very  relaxed sandbox, with only --caps.drop=all and --nonew‐
139              privs. Programs that raise user privileges are not supported  in
140              order  to  allow  strace  to  run.  Chromium  and Chromium-based
141              browsers will not work.
142
143              Example:
144              $ firejail --build=profile-file vlc ~/Videos/test.mp4
145
146       --build=profile-file
147              The command builds a whitelisted profile, and saves it  in  pro‐
148              file-file.  If  /usr/bin/strace  is  installed on the system, it
149              also builds a whitelisted seccomp profile. The program is run in
150              a  very  relaxed sandbox, with only --caps.drop=all and --nonew‐
151              privs. Programs that raise user privileges are not supported  in
152              order  to  allow  strace  to  run.  Chromium  and Chromium-based
153              browsers will not work.
154
155              Example:
156              $ firejail --build=vlc.profile vlc ~/Videos/test.mp4
157
158       -c     Execute command and exit.
159
160       --caps Linux capabilities is a kernel feature designed to split up  the
161              root  privilege into a set of distinct privileges.  These privi‐
162              leges can be enabled or disabled independently, thus restricting
163              what a process running as root can do in the system.
164
165              By  default  root  programs  run  with all capabilities enabled.
166              --caps option disables the following capabilities:  CAP_SYS_MOD‐
167              ULE, CAP_SYS_RAWIO, CAP_SYS_BOOT, CAP_SYS_NICE, CAP_SYS_TTY_CON‐
168              FIG,  CAP_SYSLOG,  CAP_MKNOD,  CAP_SYS_ADMIN.   The  filter   is
169              applied to all processes started in the sandbox.
170
171              Example:
172              $ sudo firejail --caps /etc/init.d/nginx start
173
174       --caps.drop=all
175              Drop  all capabilities for the processes running in the sandbox.
176              This option is recommended for running GUI programs or any other
177              program  that doesn't require root privileges. It is a must-have
178              option for sandboxing untrusted programs installed from  unoffi‐
179              cial sources - such as games, Java programs, etc.
180
181              Example:
182              $ firejail --caps.drop=all warzone2100
183
184       --caps.drop=capability,capability,capability
185              Define a custom blacklist Linux capabilities filter.
186
187              Example:
188              $ firejail --caps.drop=net_broadcast,net_admin,net_raw
189
190       --caps.keep=capability,capability,capability
191              Define a custom whitelist Linux capabilities filter.
192
193              Example:
194              $   sudo   firejail  --caps.keep=chown,net_bind_service,setgid,
195              setuid /etc/init.d/nginx start
196
197       --caps.print=name|pid
198              Print the caps filter for the sandbox identified by name  or  by
199              PID.
200
201              Example:
202              $ firejail --name=mygame --caps.drop=all warzone2100 &
203              $ firejail --caps.print=mygame
204
205              Example:
206              $ firejail --list
207              3272:netblue:firejail --private firefox
208              $ firejail --caps.print=3272
209
210       --cgroup=tasks-file
211              Place  the sandbox in the specified control group. tasks-file is
212              the full path of cgroup tasks file.
213
214              Example:
215              # firejail --cgroup=/sys/fs/cgroup/g1/tasks
216
217       --chroot=dirname
218              Chroot the sandbox into a root filesystem.  Unlike  the  regular
219              filesystem  container,  the system directories are mounted read-
220              write. If the sandbox is started as a regular user, default sec‐
221              comp  and  capabilities  filters are enabled. This option is not
222              available on Grsecurity systems.
223
224              Example:
225              $ firejail --chroot=/media/ubuntu warzone2100
226
227       --cpu=cpu-number,cpu-number,cpu-number
228              Set CPU affinity.
229
230              Example:
231              $ firejail --cpu=0,1 handbrake
232
233       --cpu.print=name|pid
234              Print the CPU cores in use by the sandbox identified by name  or
235              by PID.
236
237              Example:
238              $ firejail --name=mygame --caps.drop=all warzone2100 &
239              $ firejail --cpu.print=mygame
240
241              Example:
242              $ firejail --list
243              3272:netblue:firejail --private firefox
244              $ firejail --cpu.print=3272
245
246       --csh  Use /bin/csh as default user shell.
247
248              Example:
249              $ firejail --csh
250
251       --debug
252              Print debug messages.
253
254              Example:
255              $ firejail --debug firefox
256
257       --debug-blacklists
258              Debug blacklisting.
259
260              Example:
261              $ firejail --debug-blacklists firefox
262
263       --debug-caps
264              Print  all recognized capabilities in the current Firejail soft‐
265              ware build and exit.
266
267              Example:
268              $ firejail --debug-caps
269
270       --debug-check-filename
271              Debug filename checking.
272
273              Example:
274              $ firejail --debug-check-filename firefox
275
276       --debug-errnos
277              Print all recognized error numbers in the current Firejail soft‐
278              ware build and exit.
279
280              Example:
281              $ firejail --debug-errnos
282
283       --debug-private-lib
284              Debug messages for --private-lib option.
285
286       --debug-protocols
287              Print  all recognized protocols in the current Firejail software
288              build and exit.
289
290              Example:
291              $ firejail --debug-protocols
292
293       --debug-syscalls
294              Print all recognized system calls in the current Firejail  soft‐
295              ware build and exit.
296
297              Example:
298              $ firejail --debug-syscalls
299
300       --debug-whitelists
301              Debug whitelisting.
302
303              Example:
304              $ firejail --debug-whitelists firefox
305
306       --defaultgw=address
307              Use  this  address  as default gateway in the new network names‐
308              pace.
309
310              Example:
311              $ firejail --net=eth0 --defaultgw=10.10.20.1 firefox
312
313       --disable-mnt
314              Disable /mnt, /media, /run/mount and /run/media access.
315
316              Example:
317              $ firejail --disable-mnt firefox
318
319       --dns=address
320              Set a DNS server for the sandbox. Up to three DNS servers can be
321              defined.   Use  this  option if you don't trust the DNS setup on
322              your network.
323
324              Example:
325              $ firejail --dns=8.8.8.8 --dns=8.8.4.4 firefox
326
327              Note: this feature is not supported on systemd-resolved setups.
328
329       --dns.print=name|pid
330              Print DNS configuration for a sandbox identified by name  or  by
331              PID.
332
333              Example:
334              $ firejail --name=mygame --caps.drop=all warzone2100 &
335              $ firejail --dns.print=mygame
336
337              Example:
338              $ firejail --list
339              3272:netblue:firejail --private firefox
340              $ firejail --dns.print=3272
341
342       --env=name=value
343              Set environment variable in the new sandbox.
344
345              Example:
346              $ firejail --env=LD_LIBRARY_PATH=/opt/test/lib
347
348       --force
349              By  default,  if  Firejail is started in an existing sandbox, it
350              will run the program in a bash shell.  This option disables this
351              behavior,  and  attempts to start Firejail in the existing sand‐
352              box.  There could be lots of reasons for it to fail, for example
353              if  the existing sandbox disables admin capabilities, SUID bina‐
354              ries, or if it runs seccomp.
355
356       --fs.print=name|print
357              Print the filesystem log for the sandbox identified by  name  or
358              by PID.
359
360              Example:
361              $ firejail --name=mygame --caps.drop=all warzone2100 &
362              $ firejail --fs.print=mygame
363
364              Example:
365              $ firejail --list
366              3272:netblue:firejail --private firefox
367              $ firejail --fs.print=3272
368
369       --get=name|pid filename
370              Get a file from sandbox container, see FILE TRANSFER section for
371              more details.
372
373       --git-install
374              Download, compile and install mainline git version  of  Firejail
375              from  the  official  repository  on  GitHub.   The  software  is
376              installed in /usr/local/bin, and takes precedence over the (old)
377              version installed in /usr/bin. If for any reason the new version
378              doesn't work, the user can uninstall  it  using  --git-uninstall
379              command and revert to the old version.
380
381              Prerequisites:  git  and  compile  support are required for this
382              command to  work.  On  Debian/Ubuntu  systems  this  support  is
383              installed using "sudo apt-get install build-essential git".
384
385              Example:
386
387              $ firejail --git-install
388
389       --git-uninstall
390              Remove    the   Firejail   version   previously   installed   in
391              /usr/local/bin using --git-install command.
392
393              Example:
394
395              $ firejail --git-uninstall
396
397       -?, --help
398              Print options end exit.
399
400       --hostname=name
401              Set sandbox hostname.
402
403              Example:
404              $ firejail --hostname=officepc firefox
405
406       --hosts-file=file
407              Use file as /etc/hosts.
408
409              Example:
410              $ firejail --hosts-file=~/myhosts firefox
411
412       --ignore=command
413              Ignore command in profile file.
414
415              Example:
416              $ firejail --ignore=shell --ignore=seccomp firefox
417
418       --interface=interface
419              Move interface in a new network namespace. Up to  four  --inter‐
420              face  options can be specified.  Note: wlan devices are not sup‐
421              ported for this option.
422
423              Example:
424              $ firejail --interface=eth1 --interface=eth0.vlan100
425
426       --ip=address
427              Assign IP addresses to the last network interface defined  by  a
428              --net option. A default gateway is assigned by default.
429
430              Example:
431              $ firejail --net=eth0 --ip=10.10.20.56 firefox
432
433       --ip=none
434              No IP address and no default gateway are configured for the last
435              interface defined by a --net option. Use this option in case you
436              intend to start an external DHCP client in the sandbox.
437
438              Example:
439              $ firejail --net=eth0 --ip=none
440
441              If  the  corresponding interface doesn't have an IP address con‐
442              figured, this option is enabled by default.
443
444       --ip6=address
445              Assign IPv6 addresses to the last network interface defined by a
446              --net option.
447
448              Example:
449              $ firejail --net=eth0 --ip6=2001:0db8:0:f101::1/64 firefox
450
451              Note:  you don't need this option if you obtain your ip6 address
452              from router via SLAAC (your ip6 address and default  route  will
453              be configured by kernel automatically).
454
455       --iprange=address,address
456              Assign  an  IP address in the provided range to the last network
457              interface defined by  a  --net  option.  A  default  gateway  is
458              assigned by default.
459
460              Example:
461              $ firejail --net=eth0 --iprange=192.168.1.100,192.168.1.150
462
463       --ipc-namespace
464              Enable  a new IPC namespace if the sandbox was started as a reg‐
465              ular user. IPC namespace is enabled  by  default  for  sandboxes
466              started as root.
467
468              Example:
469              $ firejail --ipc-namespace firefox
470
471       --join=name|pid
472              Join  the  sandbox  identified  by  name or by PID. By default a
473              /bin/bash shell is started after joining the sandbox.  If a pro‐
474              gram  is specified, the program is run in the sandbox. If --join
475              command is issued as a regular user, all  security  filters  are
476              configured  for  the new process the same they are configured in
477              the sandbox.  If --join command is issued as root, the  security
478              filters,  cgroups and cpus configurations are not applied to the
479              process joining the sandbox.
480
481              Example:
482              $ firejail --name=mygame --caps.drop=all warzone2100 &
483              $ firejail --join=mygame
484
485              Example:
486              $ firejail --list
487              3272:netblue:firejail --private firefox
488              $ firejail --join=3272
489
490       --join-filesystem=name|pid
491              Join the mount namespace of the sandbox identified  by  name  or
492              PID.  By  default a /bin/bash shell is started after joining the
493              sandbox.  If a program is specified, the program is run  in  the
494              sandbox.  This command is available only to root user.  Security
495              filters, cgroups and cpus configurations are not applied to  the
496              process joining the sandbox.
497
498       --join-network=name|PID
499              Join the network namespace of the sandbox identified by name. By
500              default a /bin/bash shell is started after joining the  sandbox.
501              If  a  program  is specified, the program is run in the sandbox.
502              This command is available only to root user.  Security  filters,
503              cgroups  and  cpus configurations are not applied to the process
504              joining the sandbox. Example:
505
506              # start firefox
507              $ firejail --net=eth0 --name=browser firefox &
508
509              # change netfilter configuration
510              $ sudo firejail --join-network=browser bash -c  "cat  /etc/fire‐
511              jail/nolocal.net | /sbin/iptables-restore"
512
513              # verify netfilter configuration
514              $ sudo firejail --join-network=browser /sbin/iptables -vL
515
516              # verify  IP addresses
517              $ sudo firejail --join-network=browser ip addr
518              Switching  to pid 1932, the first child process inside the sand‐
519              box
520              1: lo:   mtu  65536  qdisc  noqueue  state
521              UNKNOWN group default
522                  link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
523                  inet 127.0.0.1/8 scope host lo
524                     valid_lft forever preferred_lft forever
525                  inet6 ::1/128 scope host
526                     valid_lft forever preferred_lft forever
527              2:  eth0-1931:   mtu 1500 qdisc
528              noqueue state UNKNOWN group default
529                  link/ether 76:58:14:42:78:e4 brd ff:ff:ff:ff:ff:ff
530                  inet  192.168.1.158/24  brd   192.168.1.255   scope   global
531              eth0-1931
532                     valid_lft forever preferred_lft forever
533                  inet6 fe80::7458:14ff:fe42:78e4/64 scope link
534                     valid_lft forever preferred_lft forever
535
536       --join-or-start=name
537              Join the sandbox identified by name or start a new one.  Same as
538              "firejail --join=name" if sandbox with  specified  name  exists,
539              otherwise same as "firejail --name=name ..."
540              Note  that in contrary to other join options there is respective
541              profile option.
542
543       --ls=name|pid dir_or_filename
544              List files in sandbox container, see FILE TRANSFER  section  for
545              more details.
546
547       --list List all sandboxes, see MONITORING section for more details.
548
549              Example:
550              $ firejail --list
551              7015:netblue:firejail firefox
552              7056:netblue:firejail --net=eth0 transmission-gtk
553              7064:netblue:firejail --noroot xterm
554              $
555
556       --mac=address
557              Assign  MAC addresses to the last network interface defined by a
558              --net option.
559
560              Example:
561              $ firejail --net=eth0 --mac=00:11:22:33:44:55 firefox
562
563       --machine-id
564              Spoof id number in /etc/machine-id file - a  new  random  id  is
565              generated inside the sandbox.
566
567              Example:
568              $ firejail --machine-id
569
570       --memory-deny-write-execute
571              Install a seccomp filter to block attempts to create memory map‐
572              pings that are both writable and executable, to change  mappings
573              to  be  executable,  or  to create executable shared memory. The
574              filter  examines  the  arguments  of  mmap,   mmap2,   mprotect,
575              pkey_mprotect  and  shmat  system calls and kills the process if
576              necessary.
577
578              Note: shmat is not implemented as a system call  on  some  plat‐
579              forms including i386, and it cannot be handled by seccomp-bpf.
580
581       --mtu=number
582              Assign  a  MTU  value to the last network interface defined by a
583              --net option.
584
585              Example:
586              $ firejail --net=eth0 --mtu=1492
587
588       --name=name
589              Set sandbox name. Several options, such as  --join  and  --shut‐
590              down, can use this name to identify a sandbox.
591
592              Example:
593              $ firejail --name=mybrowser firefox
594
595       --net=bridge_interface
596              Enable  a  new  network  namespace and connect it to this bridge
597              interface.  Unless specified with option --ip  and  --defaultgw,
598              an  IP  address and a default gateway will be assigned automati‐
599              cally to the sandbox. The  IP  address  is  verified  using  ARP
600              before  assignment. The address configured as default gateway is
601              the bridge device IP address. Up to four  --net  bridge  devices
602              can be defined. Mixing bridge and macvlan devices is allowed.
603
604              Example:
605              $ sudo brctl addbr br0
606              $ sudo ifconfig br0 10.10.20.1/24
607              $ sudo brctl addbr br1
608              $ sudo ifconfig br1 10.10.30.1/24
609              $ firejail --net=br0 --net=br1
610
611       --net=ethernet_interface
612              Enable  a  new network namespace and connect it to this ethernet
613              interface using the standard Linux macvlan driver. Unless speci‐
614              fied  with  option  --ip  and  --defaultgw,  an IP address and a
615              default gateway will be assigned automatically to  the  sandbox.
616              The  IP  address  is  verified  using ARP before assignment. The
617              address configured as default gateway is the default gateway  of
618              the host. Up to four --net devices can be defined. Mixing bridge
619              and macvlan devices is allowed.  Note: wlan devices are not sup‐
620              ported for this option.
621
622              Example:
623              $ firejail --net=eth0 --ip=192.168.1.80 --dns=8.8.8.8 firefox
624
625       --net=none
626              Enable  a new, unconnected network namespace. The only interface
627              available in the new namespace is a new loopback interface (lo).
628              Use  this  option  to deny network access to programs that don't
629              really need network access.
630
631              Example:
632              $ firejail --net=none vlc
633
634              Note: --net=none can crash the application  on  some  platforms.
635              In these cases, it can be replaced with --protocol=unix.
636
637       --netns=name
638              Run the program in a named, persistent network namespace.  These
639              can be created and configured using "ip netns".
640
641       --netfilter
642              Enable a default firewall if a new network namespace is  created
643              inside  the  sandbox.   This  option has no effect for sandboxes
644              using the system network namespace.
645
646              The default firewall is optimized for regular  desktop  applica‐
647              tions. No incoming connections are accepted:
648
649              *filter
650              :INPUT DROP [0:0]
651              :FORWARD DROP [0:0]
652              :OUTPUT ACCEPT [0:0]
653              -A INPUT -i lo -j ACCEPT
654              -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
655              # allow ping
656              -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
657              -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT
658              -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
659              # drop STUN (WebRTC) requests
660              -A OUTPUT -p udp --dport 3478 -j DROP
661              -A OUTPUT -p udp --dport 3479 -j DROP
662              -A OUTPUT -p tcp --dport 3478 -j DROP
663              -A OUTPUT -p tcp --dport 3479 -j DROP
664              COMMIT
665
666              Example:
667              $ firejail --net=eth0 --netfilter firefox
668
669       --netfilter=filename
670              Enable  the  firewall  specified  by  filename  if a new network
671              namespace is created inside the sandbox.   This  option  has  no
672              effect for sandboxes using the system network namespace.
673
674              Please use the regular iptables-save/iptables-restore format for
675              the  filter  file.  The  following  examples  are  available  in
676              /etc/firejail directory:
677
678              webserver.net is a webserver firewall that allows access only to
679              TCP ports 80 and 443.  Example:
680
681              $ firejail --netfilter=/etc/firejail/webserver.net --net=eth0 
682              /etc/init.d/apache2 start
683
684              nolocal.net is a desktop client firewall that disable access  to
685              local network. Example:
686
687              $ firejail --netfilter=/etc/firejail/nolocal.net 
688              --net=eth0 firefox
689
690       --netfilter=filename,arg1,arg2,arg3 ...
691              This  is  the  template  version of the previous command. $ARG1,
692              $ARG2, $ARG3 ... in the firewall script are replaced with  arg1,
693              arg2,  arg3  ...  passed on the command line. Up to 16 arguments
694              are supported.  Example:
695
696              $ firejail --net=eth0 --ip=192.168.1.105 
697              --netfilter=/etc/firejail/tcpserver.net,5001 server-program
698
699       --netfilter.print=name|pid
700              Print the firewall installed in the sandbox specified by name or
701              PID. Example:
702
703              $ firejail --name=browser --net=eth0 --netfilter firefox &
704              $ firejail --netfilter.print=browser
705
706       --netfilter6=filename
707              Enable  the IPv6 firewall specified by filename if a new network
708              namespace is created inside the sandbox.   This  option  has  no
709              effect for sandboxes using the system network namespace.  Please
710              use the regular iptables-save/iptables-restore  format  for  the
711              filter file.
712
713       --netfilter6.print=name|pid
714              Print  the  IPv6  firewall installed in the sandbox specified by
715              name or PID. Example:
716
717              $ firejail --name=browser --net=eth0 --netfilter firefox &
718              $ firejail --netfilter6.print=browser
719
720       --netstats
721              Monitor network namespace statistics, see MONITORING section for
722              more details.
723
724              Example:
725
726              $ firejail --netstats
727              PID  User    RX(KB/s) TX(KB/s) Command
728              1294 netblue 53.355   1.473    firejail --net=eth0 firefox
729              7383 netblue 9.045    0.112    firejail --net=eth0 transmission
730
731       --nice=value
732              Set  nice  value  for  all processes running inside the sandbox.
733              Only root may specify a negative value.
734
735              Example:
736              $ firejail --nice=2 firefox
737
738       --no3d Disable 3D hardware acceleration.
739
740              Example:
741              $ firejail --no3d firefox
742
743       --noblacklist=dirname_or_filename
744              Disable blacklist for this directory or file.
745
746              Example:
747              $ firejail
748              $ nc dict.org 2628
749              bash: /bin/nc: Permission denied
750              $ exit
751
752              $ firejail --noblacklist=/bin/nc
753              $ nc dict.org 2628
754              220 pan.alephnull.com dictd 1.12.1/rf on Linux 3.14-1-amd64
755
756       --nodvd
757              Disable DVD and audio CD devices.
758
759              Example:
760              $ firejail --nodvd
761
762       --noexec=dirname_or_filename
763              Remount directory or file noexec, nodev and nosuid.  File  glob‐
764              bing is supported, see FILE GLOBBING section for more details.
765
766              Example:
767              $ firejail --noexec=/tmp
768
769              /etc  and  /var are noexec by default if the sandbox was started
770              as a regular user. If there are more than one mount operation on
771              the  path  of the file or directory, noexec should be applied to
772              the last one. Always check if the change took effect inside  the
773              sandbox.
774
775       --nogroups
776              Disable supplementary groups. Without this option, supplementary
777              groups are enabled for the user starting the sandbox.  For  root
778              user supplementary groups are always disabled.
779
780              Note:  By  default  all regular user groups are removed with the
781              exception of  the  current  user.  This  can  be  changed  using
782              --allusers command option.
783
784              Example:
785              $ id
786              uid=1000(netblue)       gid=1000(netblue)       groups=1000(net‐
787              blue),24(cdrom),25(floppy),27(sudo),29(audio)
788              $ firejail --nogroups
789              Parent pid 8704, child pid 8705
790              Child process initialized
791              $ id
792              uid=1000(netblue) gid=1000(netblue) groups=1000(netblue)
793              $
794
795       --noprofile
796              Do not use a security profile.
797
798              Example:
799              $ firejail
800              Reading profile /etc/firejail/default.profile
801              Parent pid 8553, child pid 8554
802              Child process initialized
803              [...]
804
805              $ firejail --noprofile
806              Parent pid 8553, child pid 8554
807              Child process initialized
808              [...]
809
810       --noroot
811              Install a user namespace with a single user - the current  user.
812              root  user  does  not  exist  in  the new namespace. This option
813              requires a Linux kernel version 3.8 or newer. The option is  not
814              supported  for  --chroot  and  --overlay  configurations, or for
815              sandboxes started as root.
816
817              Example:
818              $ firejail --noroot
819              Parent pid 8553, child pid 8554
820              Child process initialized
821              $ ping google.com
822              ping: icmp open socket: Operation not permitted
823              $
824
825       --nonewprivs
826              Sets the NO_NEW_PRIVS prctl.  This ensures that child  processes
827              cannot  acquire  new privileges using execve(2);  in particular,
828              this means that calling a suid binary (or one with file capabil‐
829              ities)  does not result in an increase of privilege. This option
830              is enabled by default if seccomp filter is activated.
831
832       --nosound
833              Disable sound system.
834
835              Example:
836              $ firejail --nosound firefox
837
838       --notv Disable DVB (Digital Video Broadcasting) TV devices.
839
840              Example:
841              $ firejail --notv vlc
842
843       --novideo
844              Disable video devices.
845
846       --nowhitelist=dirname_or_filename
847              Disable whitelist for this directory or file.
848
849       --output=logfile
850              stdout logging and log rotation. Copy  stdout  to  logfile,  and
851              keep  the  size of the file under 500KB using log rotation. Five
852              files with prefixes .1 to .5 are used in rotation.
853
854              Example:
855              $ firejail --output=sandboxlog /bin/bash
856              [...]
857              $ ls -l sandboxlog*
858              -rw-r--r-- 1 netblue netblue 333890 Jun  2 07:48 sandboxlog
859              -rw-r--r-- 1 netblue netblue 511488 Jun  2 07:48 sandboxlog.1
860              -rw-r--r-- 1 netblue netblue 511488 Jun  2 07:48 sandboxlog.2
861              -rw-r--r-- 1 netblue netblue 511488 Jun  2 07:48 sandboxlog.3
862              -rw-r--r-- 1 netblue netblue 511488 Jun  2 07:48 sandboxlog.4
863              -rw-r--r-- 1 netblue netblue 511488 Jun  2 07:48 sandboxlog.5
864
865       --output-stderr=logfile
866              Similar to --output, but stderr is also stored.
867
868       --overlay
869              Mount a filesystem overlay on top  of  the  current  filesystem.
870              Unlike  the regular filesystem container, the system directories
871              are mounted read-write. All filesystem modifications go into the
872              overlay.   The overlay is stored in $HOME/.firejail/ direc‐
873              tory.
874
875              OverlayFS support is required in Linux kernel for this option to
876              work.   OverlayFS was officially introduced in Linux kernel ver‐
877              sion 3.18.  This option is not available on Grsecurity systems.
878
879              Example:
880              $ firejail --overlay firefox
881
882       --overlay-named=name
883              Mount a filesystem overlay on top  of  the  current  filesystem.
884              Unlike  the regular filesystem container, the system directories
885              are mounted read-write. All filesystem modifications go into the
886              overlay.  The overlay is stored in $HOME/.firejail/ direc‐
887              tory. The created overlay can be reused  between  multiple  ses‐
888              sions.
889
890              OverlayFS support is required in Linux kernel for this option to
891              work.  OverlayFS was officially introduced in Linux kernel  ver‐
892              sion 3.18.  This option is not available on Grsecurity systems.
893
894              Example:
895              $ firejail --overlay-named=jail1 firefox
896
897       --overlay-tmpfs
898              Mount a filesystem overlay on top of the current filesystem. All
899              filesystem modifications  are  discarded  when  the  sandbox  is
900              closed.
901
902              OverlayFS support is required in Linux kernel for this option to
903              work.  OverlayFS was officially introduced in Linux kernel  ver‐
904              sion 3.18.  This option is not available on Grsecurity systems.
905
906              Example:
907              $ firejail --overlay-tmpfs firefox
908
909       --overlay-clean
910              Clean all overlays stored in $HOME/.firejail directory.
911
912              Example:
913              $ firejail --overlay-clean
914
915       --private
916              Mount new /root and /home/user directories in temporary filesys‐
917              tems. All  modifications  are  discarded  when  the  sandbox  is
918              closed.
919
920              Example:
921              $ firejail --private firefox
922
923       --private=directory
924              Use directory as user home.
925
926              Example:
927              $ firejail --private=/home/netblue/firefox-home firefox
928
929       --private-home=file,directory
930              Build  a  new  user home in a temporary filesystem, and copy the
931              files and directories in the list in the new home. All modifica‐
932              tions are discarded when the sandbox is closed.
933
934              Example:
935              $ firejail --private-home=.mozilla firefox
936
937       --private-bin=file,file
938              Build  a  new  /bin in a temporary filesystem, and copy the pro‐
939              grams in the list.  If no listed file is found,  /bin  directory
940              will  be  empty.   The  same directory is also bind-mounted over
941              /sbin, /usr/bin, /usr/sbin and  /usr/local/bin.   All  modifica‐
942              tions are discarded when the sandbox is closed. File globbing is
943              supported, see FILE GLOBBING section for more details.
944
945              Example:
946              $ firejail --private-bin=bash,sed,ls,cat
947              Parent pid 20841, child pid 20842
948              Child process initialized
949              $ ls /bin
950              bash  cat  ls  sed
951
952       --private-lib=file,directory
953              This feature is currently under heavy  development.  Only  amd64
954              platforms  are supported at this moment.  The idea is to build a
955              new /lib in a temporary filesystem, with only the library  files
956              necessary to run the application.  It could be as simple as:
957
958              $ firejail --private-lib galculator
959
960              but it gets complicated really fast:
961
962              $    firejail   --private-lib=x86_64-linux-gnu/xed,x86_64-linux-
963              gnu/gdk-pixbuf-2.0,libenchant.so.1,librsvg-2.so.2 xed
964
965              The feature is integrated with --private-bin:
966
967              $ firejail --private-lib --private-bin=bash,ls,ps
968              $ ls /lib
969              ld-linux-x86-64.so.2  libgpg-error.so.0  libprocps.so.6  libsys‐
970              temd.so.0
971              libc.so.6 liblz4.so.1 libpthread.so.0 libtinfo.so.5
972              libdl.so.2 liblzma.so.5 librt.so.1 x86_64-linux-gnu
973              libgcrypt.so.20 libpcre.so.3 libselinux.so.1
974              $ ps
975               PID TTY          TIME CMD
976                  1 pts/0    00:00:00 firejail
977                 45 pts/0    00:00:00 bash
978                 48 pts/0    00:00:00 ps
979              $
980
981       --private-dev
982              Create  a  new /dev directory. Only disc, dri, null, full, zero,
983              tty, pts, ptmx, random, snd, urandom, video, log and shm devices
984              are available.
985
986              Example:
987              $ firejail --private-dev
988              Parent pid 9887, child pid 9888
989              Child process initialized
990              $ ls /dev
991              cdrom  cdrw  dri  dvd  dvdrw  full  log  null  ptmx  pts  random
992              shm  snd  sr0  tty  urandom  zero
993              $
994
995       --private-etc=file,directory
996              Build a new /etc in a temporary filesystem, and copy  the  files
997              and  directories  in the list.  If no listed file is found, /etc
998              directory will be empty.  All modifications are  discarded  when
999              the sandbox is closed.
1000
1001              Example:
1002              $ firejail --private-etc=group,hostname,localtime, 
1003              nsswitch.conf,passwd,resolv.conf
1004
1005       --private-opt=file,directory
1006              Build  a  new /opt in a temporary filesystem, and copy the files
1007              and directories in the list.  If no listed file is  found,  /opt
1008              directory  will  be empty.  All modifications are discarded when
1009              the sandbox is closed.
1010
1011              Example:
1012              $ firejail --private-opt=firefox /opt/firefox/firefox
1013
1014       --private-srv=file,directory
1015              Build a new /srv in a temporary filesystem, and copy  the  files
1016              and  directories  in the list.  If no listed file is found, /srv
1017              directory will be empty.  All modifications are  discarded  when
1018              the sandbox is closed.
1019
1020              Example:
1021              # firejail --private-srv=www /etc/init.d/apache2 start
1022
1023       --private-tmp
1024              Mount  an  empty  temporary  filesystem on top of /tmp directory
1025              whitelisting X11 and PulseAudio sockets.
1026
1027              Example:
1028              $ firejail --private-tmp
1029              $ ls -al /tmp
1030              drwxrwxrwt  4 nobody nogroup   80 Apr 30 11:46 .
1031              drwxr-xr-x 30 nobody nogroup 4096 Apr 26 22:18 ..
1032              drwx------  2  nobody  nogroup  4096  Apr  30  10:52  pulse-PKd‐
1033              htXMmr18n
1034              drwxrwxrwt  2 nobody nogroup 4096 Apr 30 10:52 .X11-unix
1035
1036       --profile=filename
1037              Load  a  custom security profile from filename. For filename use
1038              an absolute path or a path relative to the  current  path.   For
1039              more information, see SECURITY PROFILES section below.
1040
1041              Example:
1042              $ firejail --profile=myprofile
1043
1044       --profile.print=name|pid
1045              Print the name of the profile file for the sandbox identified by
1046              name or or PID.
1047
1048              Example:
1049              $ firejail --profile.print=browser
1050              /etc/firejail/firefox.profile
1051
1052       --protocol=protocol,protocol,protocol
1053              Enable protocol filter. The  filter  is  based  on  seccomp  and
1054              checks  the  first  argument  to socket system call.  Recognized
1055              values: unix, inet, inet6, netlink and packet.  This  option  is
1056              not supported for i386 architecture.
1057
1058              Example:
1059              $ firejail --protocol=unix,inet,inet6 firefox
1060
1061       --protocol.print=name|pid
1062              Print  the protocol filter for the sandbox identified by name or
1063              PID.
1064
1065              Example:
1066              $ firejail --name=mybrowser firefox &
1067              $ firejail --protocol.print=mybrowser
1068              unix,inet,inet6,netlink
1069
1070              Example:
1071              $ firejail --list
1072              3272:netblue:firejail --private firefox
1073              $ firejail --protocol.print=3272
1074              unix,inet,inet6,netlink
1075
1076       --put=name|pid src-filename dest-filename
1077              Put a file in sandbox container, see FILE TRANSFER  section  for
1078              more details.
1079
1080       --quiet
1081              Turn off Firejail's output.
1082
1083       --read-only=dirname_or_filename
1084              Set directory or file read-only. File globbing is supported, see
1085              FILE GLOBBING section for more details.
1086
1087              Example:
1088              $ firejail --read-only=~/.mozilla firefox
1089
1090              A short note about mixing --whitelist and  --read-only  options.
1091              Whitelisted  directories should be made read-only independently.
1092              Making a parent directory read-only, will not make the whitelist
1093              read-only. Example:
1094
1095              $ firejail --whitelist=~/work --read-only=~ --read-only=~/work
1096
1097       --read-write=dirname_or_filename
1098              Set  directory  or  file  read-write.  Only files or directories
1099              belonging to the current user are allowed  for  this  operation.
1100              File  globbing  is supported, see FILE GLOBBING section for more
1101              details.  Example:
1102
1103              $ mkdir ~/test
1104              $ touch ~/test/a
1105              $ firejail --read-only=~/test --read-write=~/test/a
1106
1107       --rlimit-as=number
1108              Set the maximum size of the process's  virtual  memory  (address
1109              space) in bytes.
1110
1111       --rlimit-cpu=number
1112              Set  the  maximum  limit, in seconds, for the amount of CPU time
1113              each sandboxed process  can consume. When the limit is  reached,
1114              the processes are killed.
1115
1116              The  CPU  limit  is  a  limit on CPU seconds rather than elapsed
1117              time. CPU seconds is basically how many seconds the CPU has been
1118              in  use  and does not necessarily directly relate to the elapsed
1119              time. Linux kernel keeps track of CPU seconds for  each  process
1120              independently.
1121
1122       --rlimit-fsize=number
1123              Set the maximum file size that can be created by a process.
1124
1125       --rlimit-nofile=number
1126              Set the maximum number of files that can be opened by a process.
1127
1128       --rlimit-nproc=number
1129              Set  the maximum number of processes that can be created for the
1130              real user ID of the calling process.
1131
1132       --rlimit-sigpending=number
1133              Set the maximum number of pending signals for a process.
1134
1135       --rmenv=name
1136              Remove environment variable in the new sandbox.
1137
1138              Example:
1139              $ firejail --rmenv=DBUS_SESSION_BUS_ADDRESS
1140
1141       --scan ARP-scan all the networks from inside a network namespace.  This
1142              makes  it  possible to detect macvlan kernel device drivers run‐
1143              ning on the current host.
1144
1145              Example:
1146              $ firejail --net=eth0 --scan
1147
1148       --seccomp
1149              Enable seccomp filter and blacklist the syscalls in the  default
1150              list (@default). The default list is as follows: mount, umount2,
1151              ptrace,    kexec_load,    kexec_file_load,    name_to_handle_at,
1152              open_by_handle_at,   create_module,  init_module,  finit_module,
1153              delete_module, iopl, ioperm, ioprio_set, swapon,  swapoff,  sys‐
1154              log,  process_vm_readv,  process_vm_writev,  sysfs,_sysctl, adj‐
1155              timex,  clock_adjtime,  lookup_dcookie,  perf_event_open,   fan‐
1156              otify_init,  kcmp,  add_key,  request_key, keyctl, uselib, acct,
1157              modify_ldt,  pivot_root,  io_setup,  io_destroy,   io_getevents,
1158              io_submit,  io_cancel,  remap_file_pages,  mbind, set_mempolicy,
1159              migrate_pages, move_pages, vmsplice,  chroot,  tuxcall,  reboot,
1160              mfsservctl,  get_kernel_syms,  bpf,  clock_settime, personality,
1161              process_vm_writev, query_module,  settimeofday,  stime,  umount,
1162              userfaultfd,  ustat, vm86, vm86old, afs_syscall, bdflush, break,
1163              ftime,  getpmsg,  gtty,  lock,  mpx,  pciconfig_iobase,  pcicon‐
1164              fig_read,   pciconfig_write,   prof,   profil,   putpmsg,  rtas,
1165              s390_runtime_instr, s390_mmio_read,  s390_mmio_write,  security,
1166              setdomainname,   sethostname,  sgetmask,  ssetmask,  stty,  sub‐
1167              page_prot, switch_endian, ulimit, vhangup and vserver.
1168
1169              To help creating useful seccomp filters more easily, the follow‐
1170              ing  system  call  groups  are  defined: @clock, @cpu-emulation,
1171              @debug, @default, @default-nodebuggers, @default-keep,  @module,
1172              @obsolete,  @privileged, @raw-io, @reboot, @resources and @swap.
1173              In addtion, a system call can be specified by its number instead
1174              of  name  with  prefix  $, so for example $165 would be equal to
1175              mount on i386.
1176
1177              System architecture is strictly  imposed  only  if  flag  --sec‐
1178              comp.block-secondary  is used. The filter is applied at run time
1179              only if the correct architecture was detected. For the  case  of
1180              I386 and AMD64 both 32-bit and 64-bit filters are installed.
1181
1182              Firejail  will  print seccomp violations to the audit log if the
1183              kernel was compiled with audit support (CONFIG_AUDIT flag).
1184
1185              Example:
1186              $ firejail --seccomp
1187
1188       --seccomp=syscall,@group
1189              Enable seccomp filter, blacklist the default list (@default) and
1190              the syscalls or syscall groups specified by the command.
1191
1192              Example:
1193              $ firejail --seccomp=utime,utimensat,utimes firefox
1194              $ firejail --seccomp=@clock,mkdir,unlinkat transmission-gtk
1195
1196              Instead  of dropping the syscall, a specific error number can be
1197              returned using syscall:errorno syntax.
1198
1199              Example: $ firejail --seccomp=unlinkat:ENOENT,utimensat,utimes
1200              Parent pid 10662, child pid 10663
1201              Child process initialized
1202              $ touch testfile
1203              $ rm testfile
1204              rm: cannot remove `testfile': Operation not permitted
1205
1206              If the blocked system calls would also block Firejail from oper‐
1207              ating, they are handled by adding a preloaded library which per‐
1208              forms seccomp system calls later.
1209
1210              Example:
1211              $ firejail --noprofile --shell=none --seccomp=execve bash
1212              Parent pid 32751, child pid 32752
1213              Post-exec seccomp protector enabled
1214              list in: execve,  check  list:  @default-keep  prelist:  (null),
1215              postlist: execve
1216              Child process initialized in 46.44 ms
1217              $ ls
1218              Bad system call
1219
1220       --seccomp.block_secondary
1221              Enable  seccomp  filter  and filter system call architectures so
1222              that only the native architecture is allowed.  For  example,  on
1223              amd64, i386 and x32 system calls are blocked as well as changing
1224              the execution domain with personality(2) system call.
1225
1226       --seccomp.drop=syscall,@group
1227              Enable seccomp filter, and blacklist the syscalls or the syscall
1228              groups specified by the command.
1229
1230              Example:
1231              $ firejail --seccomp.drop=utime,utimensat,utimes,@clock
1232
1233              Instead  of dropping the syscall, a specific error number can be
1234              returned using syscall:errorno syntax.
1235
1236              Example:
1237              $ firejail --seccomp.drop=unlinkat:ENOENT,utimensat,utimes
1238              Parent pid 10662, child pid 10663
1239              Child process initialized
1240              $ touch testfile
1241              $ rm testfile
1242              rm: cannot remove `testfile': Operation not permitted
1243
1244       --seccomp.keep=syscall,syscall,syscall
1245              Enable seccomp filter, and whitelist the syscalls  specified  by
1246              the   command.  The  system  calls  needed  by  Firejail  (group
1247              @default-keep: prctl,  execve)  are  handled  with  the  preload
1248              library.
1249
1250              Example:
1251              $  firejail --shell=none --seccomp.keep=poll,select,[...] trans‐
1252              mission-gtk
1253
1254       --seccomp.print=name|PID
1255              Print the seccomp filter for the sandbox identified by  name  or
1256              PID.
1257
1258              Example:
1259              $ firejail --name=browser firefox &
1260              $ firejail --seccomp.print=browser
1261              SECCOMP Filter:
1262                VALIDATE_ARCHITECTURE
1263                EXAMINE_SYSCALL
1264                BLACKLIST 165 mount
1265                BLACKLIST 166 umount2
1266                BLACKLIST 101 ptrace
1267                BLACKLIST 246 kexec_load
1268                BLACKLIST 304 open_by_handle_at
1269                BLACKLIST 175 init_module
1270                BLACKLIST 176 delete_module
1271                BLACKLIST 172 iopl
1272                BLACKLIST 173 ioperm
1273                BLACKLIST 167 swapon
1274                BLACKLIST 168 swapoff
1275                BLACKLIST 103 syslog
1276                BLACKLIST 310 process_vm_readv
1277                BLACKLIST 311 process_vm_writev
1278                BLACKLIST 133 mknod
1279                BLACKLIST 139 sysfs
1280                BLACKLIST 156 _sysctl
1281                BLACKLIST 159 adjtimex
1282                BLACKLIST 305 clock_adjtime
1283                BLACKLIST 212 lookup_dcookie
1284                BLACKLIST 298 perf_event_open
1285                BLACKLIST 300 fanotify_init
1286                RETURN_ALLOW
1287              $
1288
1289       --shell=none
1290              Run the program directly, without a user shell.
1291
1292              Example:
1293              $ firejail --shell=none script.sh
1294
1295       --shell=program
1296              Set  default  user  shell. Use this shell to run the application
1297              using -c shell option.  For example "firejail  --shell=/bin/dash
1298              firefox"  will  start Mozilla Firefox as "/bin/dash -c firefox".
1299              By default Bash shell (/bin/bash) is used. Options such as --zsh
1300              and --csh can also set the default shell.
1301
1302              Example: $firejail --shell=/bin/dash script.sh
1303
1304       --shutdown=name|PID
1305              Shutdown the sandbox identified by name or PID.
1306
1307              Example:
1308              $ firejail --name=mygame --caps.drop=all warzone2100 &
1309              $ firejail --shutdown=mygame
1310
1311              Example:
1312              $ firejail --list
1313              3272:netblue:firejail --private firefox
1314              $ firejail --shutdown=3272
1315
1316       --timeout=hh:mm:ss
1317              Kill  the  sandbox automatically after the time has elapsed. The
1318              time is specified in hours/minutes/seconds format.
1319
1320              $ firejail --timeout=01:30:00 firefox
1321
1322       --tmpfs=dirname
1323              Mount a tmpfs filesystem on directory dirname.  This  option  is
1324              available  only when running the sandbox as root.  File globbing
1325              is supported, see FILE GLOBBING section for more details.
1326
1327              Example:
1328              # firejail --tmpfs=/var
1329
1330       --top  Monitor the most CPU-intensive sandboxes, see MONITORING section
1331              for more details.
1332
1333              Example:
1334              $ firejail --top
1335
1336       --trace
1337              Trace open, access and connect system calls.
1338
1339              Example:
1340              $ firejail --trace wget -q www.debian.org
1341              Reading profile /etc/firejail/wget.profile
1342              3:wget:fopen64 /etc/wgetrc:0x5c8e8ce6c0
1343              3:wget:fopen /etc/hosts:0x5c8e8cfb70
1344              3:wget:socket AF_INET SOCK_DGRAM IPPROTO_IP:3
1345              3:wget:connect 3 8.8.8.8 port 53:0
1346              3:wget:socket AF_INET SOCK_STREAM IPPROTO_IP:3
1347              3:wget:connect 3 130.89.148.14 port 80:0
1348              3:wget:fopen64 index.html:0x5c8e8d1a60
1349
1350              parent is shutting down, bye...
1351
1352       --tracelog
1353              This  option enables auditing blacklisted files and directories.
1354              A message is sent to syslog in case the file or the directory is
1355              accessed.
1356
1357              Example:
1358              $ firejail --tracelog firefox
1359
1360              Sample messages:
1361              $ sudo tail -f /var/log/syslog
1362              [...]
1363              Dec  3 11:43:25 debian firejail[70]: blacklist violation - sand‐
1364              box 26370, exe firefox, syscall open64, path /etc/shadow
1365              Dec  3 11:46:17 debian firejail[70]: blacklist violation - sand‐
1366              box 26370, exe firefox, syscall opendir, path /boot
1367              [...]
1368
1369       --tree Print  a tree of all sandboxed processes, see MONITORING section
1370              for more details.
1371
1372              Example:
1373              $ firejail --tree
1374              11903:netblue:firejail iceweasel
1375                11904:netblue:iceweasel
1376                  11957:netblue:/usr/lib/iceweasel/plugin-container
1377              11969:netblue:firejail --net=eth0 transmission-gtk
1378                11970:netblue:transmission-gtk
1379
1380       --version
1381              Print program version and exit.
1382
1383              Example:
1384              $ firejail --version
1385              firejail version 0.9.27
1386
1387       --veth-name=name
1388              Use this name for the interface  connected  to  the  bridge  for
1389              --net=bridge_interface commands, instead of the default one.
1390
1391              Example:
1392              $ firejail --net=br0 --veth-name=if0
1393
1394       --whitelist=dirname_or_filename
1395              Whitelist  directory or file. A temporary file system is mounted
1396              on the top directory, and the whitelisted files are mount-binded
1397              inside.  Modifications  to  whitelisted  files  are  persistent,
1398              everything else is discarded when the sandbox is closed. The top
1399              directory  could  be  user home, /dev, /media, /mnt, /opt, /srv,
1400              /var, and /tmp.
1401
1402              Symbolic link handling: with the exception of  user  home,  both
1403              the  link and the real file should be in the same top directory.
1404              For user home, both the link and the real file should  be  owned
1405              by the user.
1406
1407              Example:
1408              $ firejail --noprofile --whitelist=~/.mozilla
1409              $ firejail --whitelist=/tmp/.X11-unix --whitelist=/dev/null
1410              $ firejail "--whitelist=/home/username/My Virtual Machines"
1411
1412       --writable-etc
1413              Mount /etc directory read-write.
1414
1415              Example:
1416              $ sudo firejail --writable-etc
1417
1418       --writable-run-user
1419              Disable  the  default blacklisting of /run/user/$UID/systemd and
1420              /run/user/$UID/gnupg.
1421
1422              Example:
1423              $ sudo firejail --writable-run-user
1424
1425       --writable-var
1426              Mount /var directory read-write.
1427
1428              Example:
1429              $ sudo firejail --writable-var
1430
1431       --writable-var-log
1432              Use the real /var/log directory, not  a  clone.  By  default,  a
1433              tmpfs  is  mounted  on top of /var/log directory, and a skeleton
1434              filesystem is created based on the original /var/log.
1435
1436              Example:
1437              $ sudo firejail --writable-var-log
1438
1439       --x11  Sandbox the application using Xpra, Xephyr, Xvfb or  Xorg  secu‐
1440              rity  extension.   The sandbox will prevents screenshot and key‐
1441              logger applications started inside the  sandbox  from  accessing
1442              clients  running  outside  the sandbox.  Firejail will try first
1443              Xpra, and if Xpra is not installed on the system, it will try to
1444              find  Xephyr.   If  all  fails, Firejail will not attempt to use
1445              Xvfb or X11 security extension.
1446
1447              Xpra, Xephyr and Xvfb modes require a network  namespace  to  be
1448              instantiated  in  order  to disable X11 abstract Unix socket. If
1449              this is not possible, the user can disable the  abstract  socket
1450              by  adding  "-nolisten  local"  on  Xorg  command line at system
1451              level.
1452
1453              Example:
1454              $ firejail --x11 --net=eth0 firefox
1455
1456       --x11=none
1457              Blacklist /tmp/.X11-unix directory, ${HOME}/.Xauthority and  the
1458              file  specified  in  ${XAUTHORITY} environment variable.  Remove
1459              DISPLAY and XAUTHORITY environment variables.  Stop  with  error
1460              message if X11 abstract socket will be accessible in jail.
1461
1462       --x11=xephyr
1463              Start Xephyr and attach the sandbox to this server.  Xephyr is a
1464              display server implementing the X11 display server protocol.   A
1465              network  namespace  needs  to  be  instantiated in order to deny
1466              access to X11 abstract Unix domain socket.
1467
1468              Xephyr runs in a window just like any other X11 application. The
1469              default  window  size  is  800x600.   This  can  be  modified in
1470              /etc/firejail/firejail.config file.
1471
1472              The recommended way to use this feature is to run a window  man‐
1473              ager inside the sandbox.  A security profile for OpenBox is pro‐
1474              vided.
1475
1476              Xephyr is developed by Xorg project. On Debian platforms  it  is
1477              installed  with the command sudo apt-get install xserver-xephyr.
1478              This feature is not available when running as root.
1479
1480              Example:
1481              $ firejail --x11=xephyr --net=eth0 openbox
1482
1483       --x11=xorg
1484              Sandbox the application using the untrusted mode implemented  by
1485              X11  security  extension.   The  extension  is available in Xorg
1486              package and it is installed by default on most  Linux  distribu‐
1487              tions.  It  provides support for a simple trusted/untrusted con‐
1488              nection model. Untrusted clients are restricted in certain  ways
1489              to  prevent  them from reading window contents of other clients,
1490              stealing input events, etc.
1491
1492              The untrusted mode has several limitations.  A  lot  of  regular
1493              programs   assume  they are a trusted X11 clients and will crash
1494              or lock up when run in  untrusted  mode.  Chromium  browser  and
1495              xterm are two examples.  Firefox and transmission-gtk seem to be
1496              working fine.  A network namespace  is  not  required  for  this
1497              option.
1498
1499              Example:
1500              $ firejail --x11=xorg firefox
1501
1502       --x11=xpra
1503              Start  Xpra  (https://xpra.org)  and  attach the sandbox to this
1504              server.  Xpra is a persistent remote display server  and  client
1505              for  forwarding X11 applications and desktop screens.  A network
1506              namespace needs to be instantiated in order to  deny  access  to
1507              X11 abstract Unix domain socket.
1508
1509              On Debian platforms Xpra is installed with the command sudo apt-
1510              get install xpra.  This feature is not available when running as
1511              root.
1512
1513              Example:
1514              $ firejail --x11=xpra --net=eth0 firefox
1515
1516       --x11=xvfb
1517              Start  Xvfb  X11  server  and attach the sandbox to this server.
1518              Xvfb, short for X virtual framebuffer,  performs  all  graphical
1519              operations  in memory without showing any screen output. Xvfb is
1520              mainly used for remote access and software testing  on  headless
1521              servers.
1522
1523              On Debian platforms Xvfb is installed with the command sudo apt-
1524              get install xvfb.  This feature is not available when running as
1525              root.
1526
1527              Example: remote VNC access
1528
1529              On  the  server we start a sandbox using Xvfb and openbox window
1530              manager. The default size of Xvfb screen is 800x600 - it can  be
1531              changed  in  /etc/firejail/firejail.config  (xvfb-screen).  Some
1532              sort of networking (--net) is required in order to  isolate  the
1533              abstract sockets used by other X servers.
1534
1535              $ firejail --net=none --x11=xvfb openbox
1536
1537              *** Attaching to Xvfb display 792 ***
1538
1539              Reading profile /etc/firejail/openbox.profile
1540              Reading profile /etc/firejail/disable-common.inc
1541              Reading profile /etc/firejail/disable-common.local
1542              Parent pid 5400, child pid 5401
1543
1544              On  the  server  we also start a VNC server and attach it to the
1545              display handled by our Xvfb server (792).
1546
1547              $ x11vnc -display :792
1548
1549              On the client machine we start a VNC viewer and use it  to  con‐
1550              nect to our server:
1551
1552              $ vncviewer
1553
1554       --xephyr-screen=WIDTHxHEIGHT
1555              Set screen size for --x11=xephyr. The setting will overwrite the
1556              default set in  /etc/firejail/firejail.config  for  the  current
1557              sandbox.  Run  xrandr  to get a list of supported resolutions on
1558              your computer.
1559
1560              Example:
1561              $ firejail --net=eth0 --x11=xephyr --xephyr-screen=640x480 fire‐
1562              fox
1563
1564       --zsh  Use /usr/bin/zsh as default user shell.
1565
1566              Example:
1567              $ firejail --zsh
1568
1569DESKTOP INTEGRATION
1570       A  symbolic link to /usr/bin/firejail under the name of a program, will
1571       start the program in Firejail sandbox.  The  symbolic  link  should  be
1572       placed  in  the  first $PATH position. On most systems, a good place is
1573       /usr/local/bin directory. Example:
1574
1575              Make a firefox symlink to /usr/bin/firejail:
1576
1577              $ ln -s /usr/bin/firejail /usr/local/bin/firefox
1578
1579              Verify $PATH
1580
1581              $ which -a firefox
1582              /usr/local/bin/firefox
1583              /usr/bin/firefox
1584
1585              Starting firefox in this moment, automatically invokes “firejail
1586              firefox”.
1587
1588       This  works  for  clicking on desktop environment icons, menus etc. Use
1589       "firejail --tree" to verify the program is sandboxed.
1590
1591              $ firejail --tree
1592              1189:netblue:firejail firefox
1593                1190:netblue:firejail firefox
1594                  1220:netblue:/bin/sh -c "/usr/lib/firefox/firefox"
1595                    1221:netblue:/usr/lib/firefox/firefox
1596
1597       We provide a tool that automates all this integration, please see man 1
1598       firecfg for more details.
1599
1600FILE GLOBBING
1601       Globbing is the operation that expands a wildcard pattern into the list
1602       of pathnames matching the pattern. Matching is defined by:
1603
1604              - '?' matches any character
1605              - '*' matches any string
1606              - '[' denotes a range of characters
1607
1608       The gobing feature is implemented using glibc glob  command.  For  more
1609       information on the wildcard syntax see man 7 glob.
1610
1611       The  following  command line options are supported: --blacklist, --pri‐
1612       vate-bin, --noexec, --read-only, --read-write, and --tmpfs.
1613
1614       Examples:
1615
1616              $ firejail --private-bin=sh,bash,python*
1617              $ firejail --blacklist=~/dir[1234]
1618              $ firejail --read-only=~/dir[1-4]
1619
1620APPARMOR
1621       AppArmor support is disabled by default at compile time. Use  --enable-
1622       apparmor configuration option to enable it:
1623
1624              $ ./configure --prefix=/usr --enable-apparmor
1625
1626       During  software  install,  a  generic AppArmor profile file, firejail-
1627       default, is placed in /etc/apparmor.d directory. The profile  needs  to
1628       be loaded into the kernel by running the following command as root:
1629
1630              # aa-enforce firejail-default
1631
1632       The  installed  profile  tries to replicate some advanced security fea‐
1633       tures inspired by kernel-based Grsecurity:
1634
1635              - Prevent information leakage in /proc and /sys directories. The
1636              resulting  filesystem is barely enough for running commands such
1637              as "top" and "ps aux".
1638
1639              - Allow running programs only from well-known system paths, such
1640              as  /bin, /sbin, /usr/bin etc. Running programs and scripts from
1641              user home or other directories  writable  by  the  user  is  not
1642              allowed.
1643
1644              -  Allow access to files only in the following standard directo‐
1645              ries: /bin, /dev, /etc, /home, /lib*, /media, /mnt, /opt, /proc,
1646              /root, /run, /sbin, /srv, /sys, /tmp, /usr, and /var
1647
1648              -  Disable  D-Bus. D-Bus has long been a huge security hole, and
1649              most programs don't use it anyway.  You should have no  problems
1650              running  Chromium  or Firefox. This feature is available only on
1651              Ubuntu kernels.
1652
1653       To enable AppArmor confinement on top of your current Firejail security
1654       features,  pass  --apparmor flag to Firejail command line. You can also
1655       include apparmor command in a Firejail profile file. Example:
1656
1657              $ firejail --apparmor firefox
1658
1659FILE TRANSFER
1660       These features allow the user to inspect the filesystem container of an
1661       existing  sandbox  and  transfer  files  from the container to the host
1662       filesystem.
1663
1664       --get=name|pid filename
1665              Retrieve the container file and store it on the host in the cur‐
1666              rent  working  directory.  The container is specified by name or
1667              PID.
1668
1669       --ls=name|pid dir_or_filename
1670              List container files. The container is specified by name or PID.
1671
1672       --put=name|pid src-filename dest-filename
1673              Put src-filename in sandbox container.  The container is  speci‐
1674              fied by name or PID.
1675
1676       Examples:
1677
1678              $ firejail --name=mybrowser --private firefox
1679
1680              $ firejail --ls=mybrowser ~/Downloads
1681              drwxr-xr-x netblue  netblue         4096 .
1682              drwxr-xr-x netblue  netblue         4096 ..
1683              -rw-r--r-- netblue  netblue         7847 x11-x305.png
1684              -rw-r--r-- netblue  netblue         6800 x11-x642.png
1685              -rw-r--r-- netblue  netblue        34139 xpra-clipboard.png
1686
1687              $ firejail --get=mybrowser ~/Downloads/xpra-clipboard.png
1688
1689              $  firejail --put=mybrowser xpra-clipboard.png ~/Downloads/xpra-
1690              clipboard.png
1691
1692TRAFFIC SHAPING
1693       Network bandwidth is an expensive resource shared among  all  sandboxes
1694       running  on a system.  Traffic shaping allows the user to increase net‐
1695       work performance by controlling the amount of data that flows into  and
1696       out of the sandboxes.
1697
1698       Firejail  implements  a simple rate-limiting shaper based on Linux com‐
1699       mand tc.  The shaper works at sandbox level, and can be used  only  for
1700       sandboxes configured with new network namespaces.
1701
1702       Set rate-limits:
1703
1704            $ firejail --bandwidth=name|pid set network download upload
1705
1706       Clear rate-limits:
1707
1708            $ firejail --bandwidth=name|pid clear network
1709
1710       Status:
1711
1712            $ firejail --bandwidth=name|pid status
1713
1714       where:
1715            name - sandbox name
1716            pid - sandbox pid
1717            network - network interface as used by --net option
1718            download - download speed in KB/s (kilobyte per second)
1719            upload - upload speed in KB/s (kilobyte per second)
1720
1721       Example:
1722            $ firejail --name=mybrowser --net=eth0 firefox &
1723            $ firejail --bandwidth=mybrowser set eth0 80 20
1724            $ firejail --bandwidth=mybrowser status
1725            $ firejail --bandwidth=mybrowser clear eth0
1726
1727AUDIT
1728       Audit  feature  allows the user to point out gaps in security profiles.
1729       The implementation replaces the program to be  sandboxed  with  a  test
1730       program. By default, we use faudit program distributed with Firejail. A
1731       custom test program can also be supplied by the user. Examples:
1732
1733       Running the default audit program:
1734            $ firejail --audit transmission-gtk
1735
1736       Running a custom audit program:
1737            $ firejail --audit=~/sandbox-test transmission-gtk
1738
1739       In the examples above, the sandbox configures transmission-gtk  profile
1740       and  starts  the test program. The real program, transmission-gtk, will
1741       not be started.
1742
1743       Limitations: audit feature is not implemented for --x11 commands.
1744
1745MONITORING
1746       Option --list prints a list of  all  sandboxes.  The  format  for  each
1747       process entry is as follows:
1748
1749            PID:USER:Command
1750
1751       Option  --tree prints the tree of processes running in the sandbox. The
1752       format for each process entry is as follows:
1753
1754            PID:USER:Command
1755
1756       Option --top is similar to the UNIX top  command,  however  it  applies
1757       only to sandboxes.
1758
1759       Option  --netstats  prints  network  statistics  for  active  sandboxes
1760       installing new network namespaces.
1761
1762       Listed below are the available fields (columns) in  alphabetical  order
1763       for --top and --netstat options:
1764
1765       Command
1766              Command used to start the sandbox.
1767
1768       CPU%   CPU  usage,  the sandbox share of the elapsed CPU time since the
1769              last screen update
1770
1771       PID    Unique process ID for the task controlling the sandbox.
1772
1773       Prcs   Number of processes running in sandbox, including  the  control‐
1774              ling process.
1775
1776       RES    Resident Memory Size (KiB), sandbox non-swapped physical memory.
1777              It is a sum of the RES values for all processes running  in  the
1778              sandbox.
1779
1780       RX(KB/s)
1781              Network receive speed.
1782
1783       SHR    Shared  Memory  Size (KiB), it reflects memory shared with other
1784              processes. It is a sum of the SHR values for all processes  run‐
1785              ning in the sandbox, including the controlling process.
1786
1787       TX(KB/s)
1788              Network transmit speed.
1789
1790       Uptime Sandbox running time in hours:minutes:seconds format.
1791
1792       User   The owner of the sandbox.
1793
1794SECURITY PROFILES
1795       Several command line options can be passed to the program using profile
1796       files. Firejail chooses the profile file as follows:
1797
1798       1. If a profile file is provided by the user with --profile option, the
1799       profile file is loaded.  Example:
1800
1801              $ firejail --profile=/home/netblue/icecat.profile icecat
1802              Reading profile /home/netblue/icecat.profile
1803              [...]
1804
1805       2.  If  a profile file with the same name as the application is present
1806       in ~/.config/firejail directory or in  /etc/firejail,  the  profile  is
1807       loaded.  ~/.config/firejail  takes precedence over /etc/firejail. Exam‐
1808       ple:
1809
1810              $ firejail icecat
1811              Command name #icecat#
1812              Found icecat profile in /home/netblue/.config/firejail directory
1813              Reading profile /home/netblue/.config/firejail/icecat.profile
1814              [...]
1815
1816       3. Use default.profile file if the sandbox  is  started  by  a  regular
1817       user,  or  server.profile file if the sandbox is started by root. Fire‐
1818       jail looks for these files in ~/.config/firejail directory, followed by
1819       /etc/firejail  directory.   To  disable  default  profile  loading, use
1820       --noprofile command option. Example:
1821
1822              $ firejail
1823              Reading profile /etc/firejail/default.profile
1824              Parent pid 8553, child pid 8554
1825              Child process initialized
1826              [...]
1827
1828              $ firejail --noprofile
1829              Parent pid 8553, child pid 8554
1830              Child process initialized
1831              [...]
1832
1833       See man 5 firejail-profile for profile file syntax information.
1834
1835RESTRICTED SHELL
1836       To configure a restricted shell, replace /bin/bash with  /usr/bin/fire‐
1837       jail  in  /etc/passwd  file  for each user that needs to be restricted.
1838       Alternatively, you can specify /usr/bin/firejail  in adduser command:
1839
1840       adduser --shell /usr/bin/firejail username
1841
1842       Additional arguments passed  to  firejail  executable  upon  login  are
1843       declared in /etc/firejail/login.users file.
1844
1845EXAMPLES
1846       firejail
1847              Sandbox a regular /bin/bash session.
1848
1849       firejail firefox
1850              Start Mozilla Firefox.
1851
1852       firejail --debug firefox
1853              Debug Firefox sandbox.
1854
1855       firejail --private firefox
1856              Start Firefox with a new, empty home directory.
1857
1858       firejail --net=none vlc
1859              Start VLC in an unconnected network namespace.
1860
1861       firejail --net=eth0 firefox
1862              Start  Firefox  in  a  new  network  namespace. An IP address is
1863              assigned automatically.
1864
1865       firejail --net=br0 --ip=10.10.20.5 --net=br1 --net=br2
1866              Start a /bin/bash session in a new network namespace and connect
1867              it  to  br0,  br1, and br2 host bridge devices. IP addresses are
1868              assigned automatically for the interfaces connected to  br1  and
1869              b2
1870
1871       firejail --list
1872              List all sandboxed processes.
1873
1874LICENSE
1875       This program is free software; you can redistribute it and/or modify it
1876       under the terms of the GNU General Public License as published  by  the
1877       Free  Software Foundation; either version 2 of the License, or (at your
1878       option) any later version.
1879
1880       Homepage: https://firejail.wordpress.com
1881
1882SEE ALSO
1883       firemon(1), firecfg(1), firejail-profile(5), firejail-login(5)
1884
18850.9.52                             Dec 2017                        FIREJAIL(1)