{"id":2726,"date":"2022-01-13T02:38:56","date_gmt":"2022-01-13T02:38:56","guid":{"rendered":"https:\/\/dft.wiki\/?p=2726"},"modified":"2026-06-08T21:58:25","modified_gmt":"2026-06-09T01:58:25","slug":"sandboxing-applications-with-apparmor-firejail-and-more","status":"publish","type":"post","link":"https:\/\/dft.wiki\/?p=2726","title":{"rendered":"Sandboxing Applications with AppArmor, Firejail and More"},"content":{"rendered":"

Sandboxing is a technique for confining an application to specific resources, protecting the operating system from vulnerabilities and threats.<\/p>\n

    \n
  1. AppArmor\n
      \n
    1. Uses profiles that define what a known application needs to perform its tasks and provides only those minimum resources.<\/li>\n<\/ol>\n<\/li>\n
    2. Firejail\n
        \n
      1. An easy-to-use tool to launch an application from the terminal with a few arguments as needed.<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n

        Additionally, I covered how to use iptables<\/code> to restrict applications by uid<\/code> or gid<\/code> to only use a VPN connection (tun0<\/code> from OpenVPN), and the tool proxychains<\/code> to tunnel all traffic through a proxy server or the Tor Network.<\/p>\n

        \n

        APPARMOR<\/strong><\/p>\n

        AppArmor is a kernel enhancement that sandboxes applications, giving them only the minimum resources needed to perform their tasks.<\/p>\n

        sudo apt install apparmor-profiles apparmor-utils -y\r\nsudo aa-status<\/pre>\n
        To enforce all profiles or a single profile:<\/p>\n
        sudo aa-enforce \/etc\/apparmor.d\/*\r\nsudo aa-enforce \/etc\/apparmor.d\/usr.sbin.traceroute<\/pre>\n
        \n
        FIREJAIL<\/strong><\/p>\n
        Firejail is a SUID program that reduces the risk of security breaches by restricting the running environment of untrusted or vulnerable applications with low overhead.<\/p>\n
        sudo apt install firejail firejail-profiles -y\r\nfirejail --help<\/pre>\n
        Run any application through Firejail to apply restrictions:<\/p>\n
        firejail --net=none firefox\r\nfirejail --net=tun0 firefox<\/pre>\n
        Other examples:<\/p>\n
        firejail --private --dns=8.8.8.8 --hosts-file=\/etc\/hosts firefox\r\nfirejail --net=eth0 --defaultgw=192.168.1.1 firefox\r\nfirejail --cpu=2,3 firefox<\/pre>\n
        Limiting bandwidth:<\/p>\n
        firejail --name=slow --private --net=eth0 firefox -no-remote\r\nfirejail --bandwidth=slow set eth0 200 100<\/pre>\n
        Optionally, create a bridge network (using bridge-utils<\/code> and uml-utilities<\/code>) attached to the VPN interface and force the desired application through it.<\/p>\n
        \n
        BONUS<\/strong><\/p>\n
        Restrict an application to only run through a specific network interface, such as a VPN.<\/p>\n
        sudo iptables -A OUTPUT -m owner --uid-owner debian-transmission \\! -o tun0 -j REJECT\r\nsudo -u debian-transmission transmission-gtk &<\/pre>\n
        Or add rules to keep it accessible on the local network on specific ports while still restricting its internet traffic to the VPN interface.<\/p>\n
        sudo iptables -A OUTPUT -d 192.168.0.0\/16 -p tcp --sport 9091 -m owner --gid-owner debian-transmission -o wlan0 -j ACCEPT\r\nsudo iptables -A OUTPUT -d 192.168.0.0\/16 -p udp --sport 9091 -m owner --gid-owner debian-transmission -o wlan0 -j ACCEPT\r\nsudo iptables -A OUTPUT -m owner --gid-owner debian-transmission -o tun0 -j ACCEPT\r\nsudo iptables -A OUTPUT -m owner --gid-owner debian-transmission -o lo -j ACCEPT\r\nsudo iptables -A OUTPUT -m owner --gid-owner debian-transmission -j REJECT<\/pre>\n
        See also the next post with ProxyChains usage and configuration examples [Link<\/a>] to learn how to restrict a specific application to the Tor Network.<\/p>\n
        Open Snitch<\/strong> and Little Snitch<\/strong><\/p>\n
        Monitor and intercept new network connection requests, with the ability to approve or deny them before they go through.<\/p>\n