API tools faq
paste
Advertisement
xe1phix

Xe1phix-[Firejail]-Comprehensive-[All-In-One]-Hybrid-{[Template]}-[v29.8.84]-(01-05-22).profile

xe1phix
Nov 10th, 2022
1,062
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 29.21 KB | None | 0 0
raw download clone embed print report
  1. ## ------------------------------------------------------------ ##
  2. ##   [?] Firejail profile for $Profile
  3. ## ------------------------------------------------------------ ##
  4. ##
  5. ## ------------------------------------------------------------ ##
  6. ##   [?] This file is overwritten after every install/update
  7. ## ------------------------------------------------------------ ##
  8. ##
  9. ##
  10. ## ------------------------------------------------------- ##
  11. ##  [+] Persistent local customizations
  12. ## ------------------------------------------------------- ##
  13. ## include $Profile.local
  14. ##
  15. ## ------------------------------------------------------- ##
  16. ##  [+] Persistent global definitions
  17. ## ------------------------------------------------------- ##
  18. ## include $Globals.local
  19. ## ------------------------------------------------------- ##
  20.  
  21.  
  22.  
  23. ## --------------------------------------------------------------- ##
  24. noblacklist ${HOME}/.TelegramDesktop
  25. noblacklist ${HOME}/.local/share/TelegramDesktop
  26. noblacklist ${HOME}/.local/share/TelegramDesktop/DebugLogs
  27. noblacklist ${HOME}/Downloads/Telegram Desktop/
  28. noblacklist ${HOME}/Downloads/Telegram Desktop/Telegram-Queue
  29. ## --------------------------------------------------------------- ##
  30. ## read-write ${HOME}/Downloads/Telegram Desktop/
  31. whitelist ${HOME}/Downloads/
  32. whitelist ${HOME}/Downloads/Telegram Desktop/
  33. read-only /usr/lib/parrot-skel
  34. ## --------------------------------------------------------------- ##
  35. blacklist /etc/firefox
  36. blacklist /etc/firefox-esr
  37. blacklist ${HOME}/.mozilla
  38. ## --------------------------------------------------------------- ##
  39. ## firejail --read-only=~/.mozilla firefox
  40. ## firejail --read-write=${HOME}/Downloads/
  41. ## --------------------------------------------------------------- ##
  42. read-only /run/resolvconf/resolv.conf
  43. read-only /etc/resolv.conf
  44. read-only /etc/resolv.conf.head
  45. read-only /etc/firejail/
  46. ## --------------------------------------------------------------- ##
  47. blacklist /mnt
  48. blacklist /boot
  49. blacklist /media
  50. blacklist /run/media
  51. blacklist /run/mount
  52. ## read-only /usr/local/bin
  53. ## --------------------------------------------------------------- ##
  54.  
  55.  
  56. ## --------------------------------- ##
  57. ## mkdir $Directory
  58. ## mkfile $File
  59. ## bind $File1,$File2
  60. ## bind $Directory1,$Directory2
  61. ## --------------------------------- ##
  62.  
  63.  
  64. include disable-common.inc
  65. include disable-devel.inc
  66. include disable-exec.inc
  67. include disable-interpreters.inc
  68. include disable-passwdmgr.inc
  69. include disable-programs.inc
  70. include disable-xdg.inc
  71. include disable-write-mnt.inc
  72. include disable-shell.inc
  73.  
  74.  
  75. ## ------------------------------------------------ ##
  76. ## include /etc/firejail/disable-common.inc
  77. ## include /etc/firejail/disable-devel.inc
  78. ## include /etc/firejail/disable-interpreters.inc
  79. ## include /etc/firejail/disable-passwdmgr.inc
  80. ## include /etc/firejail/disable-programs.inc
  81. ## include /etc/firejail/disable-xdg.inc
  82. ## include /etc/firejail/disable-exec.inc
  83. ## include /etc/firejail/disable-write-mnt.inc
  84. ## include /etc/firejail/disable-shell.inc
  85. ## ------------------------------------------------ ##
  86.  
  87.  
  88. ## ------------------------------------------------ ##
  89. ## include allow-bin-sh.inc
  90. ## include allow-common-devel.inc
  91. ## include whitelist-common.inc
  92. ## whitelist-player-common.inc
  93. ## include whitelist-runuser-common.inc
  94. ## include whitelist-usr-share-common.inc
  95. ## include whitelist-var-common.inc
  96. ## ------------------------------------------------ ##
  97.  
  98.  
  99. ## ------------------------------------------------ ##
  100. ##              Mullvad DNS Server
  101. ## ------------------------------------------------ ##
  102. dns 193.138.218.74
  103.  
  104. ## ------------------------------------------------ ##
  105. ##          Backplane OpenNIC DNS Server
  106. ## ------------------------------------------------ ##
  107. dns 172.98.193.62
  108.  
  109.  
  110.  
  111.  
  112. ##-===================================================-##
  113. ##   [+] Run program inside of a Network_Namespace
  114. ##-===================================================-##
  115. ## --------------------------------------------------- ##
  116. ##   [?] Must first be created, then configured using "ip netns"
  117. ## --------------------------------------------------- ##
  118.  
  119. ## -------------------------------------- ##
  120. ## netns $Namespace
  121. ## firejail --netns=
  122. ## -------------------------------------- ##
  123.  
  124.  
  125.  
  126. ## -------------------------------------- ##
  127. ## firejail --netstats
  128. ## firejail --list
  129. ## firejail --tree
  130. ## firejail --top
  131. ## -------------------------------------- ##
  132. ## firejail --net.print=$PID
  133. ## firejail --netfilter.print=$PID
  134. ## firejail --netfilter6.print=$PID
  135. ## firejail --seccomp.print=$PID
  136. ## firejail --caps.print=$PID
  137. ## firejail --dns.print=$PID
  138. ## firejail --fs.print=$PID
  139. ## firejail --profile.print=$PID
  140. ## firejail --protocol.print=$PID
  141. ## -------------------------------------- ##
  142. ##  
  143. ## ------------------------------------------- ##
  144. ##    [?] Print control group information
  145. ## ------------------------------------------- ##
  146. ##  firemon --cgroup
  147.  
  148.  
  149. ## ---------------------------------------------------------------------- ##
  150. ##   [?] Trace the syscalls being used during execution with STrace:
  151. ## ---------------------------------------------------------------------- ##
  152. ## sudo strace -u $USER $StraceOptions firejail $Syntax
  153. ##  
  154. ##  
  155. ## ---------------------------------------------------------------------- ##
  156. ##   [?] Trace the syscalls being used during execution with STrace:
  157. ## ---------------------------------------------------------------------- ##
  158. ##  firejail  --allow-debuggers --profile=/etc/firejail/firefox.profile strace -f firefox
  159.  
  160.  
  161.  
  162. ## ---------------------------------------------------------------------------- ##
  163. ##   [?] Firejail uses Linux namespaces, seccomp-bpf and Linux capabilities
  164. ## ---------------------------------------------------------------------------- ##
  165. ##   [?] Firejail can work in a SELinux or AppArmor environment,
  166. ##   [?] Firejail integrates with Linux Control Groups.
  167. ## ---------------------------------------------------------------------------- ##
  168.  
  169.  
  170. ##-==============================================================-##
  171. ##    [+] firejail-ui - Firejail sandbox configuration wizard
  172. ##-==============================================================-##
  173.  
  174.  
  175. ##-=====================================================-##
  176. ##    [+] sandbox file manager (firemgr) application
  177. ##-=====================================================-##
  178.  
  179.  
  180.  
  181. ## -------------------------------------------------- ##
  182. ##   [+] enable Firetools to start automatically
  183. ##   [?] when you log into your desktop by running:
  184. ## -------------------------------------------------- ##
  185. ##  firetools --autostart
  186.  
  187.  
  188.  
  189. ## ----------------------------------------------------------------------- ##
  190. ##   [+] Segmentation faults
  191. ## ----------------------------------------------------------------------- ##
  192. ##  [?] Check your system logs. There may be blocked syscalls
  193. ##  [?] which are logged by audit when this profile uses seccomp.
  194. ## ----------------------------------------------------------------------- ##
  195.  
  196.  
  197.  
  198. ## ----------------------------------------------------------------------- ##
  199. ##   [?] You can create, modify, and shape Firejails default profile.
  200. ## ----------------------------------------------------------------------- ##
  201. ##  
  202. ## ------------------------------------------------------------ ##
  203. ##   [?] Firejails default profile (global) configuration
  204. ##        Can be found at the following location:
  205. ## ------------------------------------------------------------ ##
  206. ##   [+] /etc/firejail/default.profile
  207. ## ------------------------------------------------------------ ##
  208. ##  
  209. ## ------------------------------------------------ ##
  210. ##   firejail --profile=default /usr/bin/$Binary
  211. ## ------------------------------------------------ ##
  212.  
  213.  
  214.  
  215. ##-==========================-##
  216. ##    [+] firejail.config
  217. ##-==========================-##
  218. ##  
  219. ## ------------------------------------------------------------ ##
  220. ##   [+] firejail.config
  221. ## ------------------------------------------------------------ ##
  222. ##   [+] firejail.config.dpkg-dist
  223. ## ------------------------------------------------------------ ##
  224. ##  
  225. ## ------------------------------------------------------------ ##
  226. ##   [+] include /etc/firejail/$File.profile
  227. ## ------------------------------------------------------------ ##
  228. ##   [+] include ~/.config/firejail/
  229. ## ------------------------------------------------------------ ##
  230. ##   [+] include ~/.local/share/applications/
  231. ## ------------------------------------------------------------ ##
  232. ##  
  233. ##  
  234. ## ----------------------------------------------------------------------- ##
  235. ##   [?] Show the current configuration being used in firejail.config:
  236. ## ----------------------------------------------------------------------- ##
  237. ## grep overlayfs /etc/firejail/firejail.config
  238.  
  239.  
  240.  
  241. ##-============================================-##
  242. ##   [+] Remove all firejail symbolic links:
  243. ##-============================================-##
  244. ##  sudo firecfg --debug --clean
  245. ##  
  246. ##  
  247. ##-===================================================================-##
  248. ##   [+] Firecfg - Desktop integration utility for Firejail software
  249. ##-===================================================================-##
  250. ## ------------------------------------------------------------------- ##
  251. ##   [?] Checks .desktop files in /usr/share/applications/
  252. ## ------------------------------------------------------------------- ##
  253. ##   [?] set or update the symbolic links for desktop integration
  254. ## ------------------------------------------------------------------- ##
  255. ##   [?] Fix .desktop files in $HOME/.local/share/applications/
  256. ## ------------------------------------------------------------------- ##
  257. ##   [?] Load and force the AppArmor profile "firejail-default"
  258. ## ------------------------------------------------------------------- ##
  259. ##  sudo firecfg --debug --fix
  260. ##  
  261. ##  
  262. ## ------------------------------------------- ##
  263. ##   [?] List all firejail symbolic links:
  264. ## ------------------------------------------- ##
  265. ##  firecfg --list
  266.  
  267.  
  268. ##-=========================================================-##
  269. ##    [+] firejail.users - Firejail user access database
  270. ##-=========================================================-##
  271. ##  cat /etc/firejail/firejail.users
  272. ##  sudo firecfg --add-users $user
  273. ##  
  274. ##  
  275. ##-==========================================-##
  276. ##   [+] Add the current user to the
  277. ##       Firejail user access database:
  278. ##-==========================================-##
  279. ## sudo firecfg --debug --add-users $User
  280. ##  
  281. ##  
  282. ##-===============================================-##
  283. ##   [+] Create  a special firejail user group:
  284. ##-===============================================-##
  285. ## ---------------------------------------------------------------- ##
  286. ##  [?] (Allowing only users in this group to run the sandbox)
  287. ## ---------------------------------------------------------------- ##
  288. ## addgroup --system firejail
  289. ## chown root:firejail /usr/bin/firejail
  290. ## chmod 4750 /usr/bin/firejail
  291.  
  292.  
  293.  
  294. ##-======================================-##
  295. ##    [+] Regular Profiles (.profile)
  296. ##-======================================-##
  297. ##  
  298. ## --------------------------------------------------------------------------------- ##
  299. ##  [?] Regular Profiles (.profile) use the firejail directory: /etc/firejail/
  300. ## --------------------------------------------------------------------------------- ##
  301.  
  302.  
  303.  
  304.  
  305. ##-===================================================-##
  306. ##    [+] Persistent global File (globals.local):
  307. ##-===================================================-##
  308. ## --------------------------------------------------------------------------------- ##
  309. ##  [?] globals.local is a special override file,
  310. ## --------------------------------------------------------------------------------- ##
  311. ##  [?] It overrides (.local) files, and affects every regular profile.
  312. ## --------------------------------------------------------------------------------- ##
  313. ##  include globals.local
  314.  
  315.  
  316.  
  317.  
  318. ##-==========================================================-##
  319. ##    [+] firejail --build - Automatic profile generation
  320. ##-==========================================================-##
  321. ## ---------------------------------------------------------- ##
  322. ##  [?] builds a whitelisted profile.
  323. ## ---------------------------------------------------------- ##
  324. ##  [?] The profile is printed on the screen.
  325. ## ---------------------------------------------------------- ##
  326. ##  [?] strace builds a whitelisted seccomp profile
  327. ## ---------------------------------------------------------- ##
  328. ##  Examples:
  329. ##  firejail --build vlc ~/Videos/test.mp4
  330. ##  firejail --build=vlc.profile vlc ~/Videos/test.mp4
  331. ## ---------------------------------------------------------- ##
  332.  
  333.  
  334. ##-====================================================-##
  335. ##    [+] Make A symbolic link to /usr/bin/firejail
  336. ##-====================================================-##
  337. ## ---------------------------------------------------- ##
  338. ##  [?] So when programs are ran, they will start
  339. ##  [?] using a Firejail sandbox by default.
  340. ## ---------------------------------------------------- ##
  341. ##  sudo ln -s /usr/bin/firejail /usr/local/bin/firefox
  342. ##
  343. ## ----------------------- ##
  344. ##    [?] Verify $PATH
  345. ## ----------------------- ##
  346. ##  which -a firefox /usr/local/bin/firefox /usr/bin/firefox
  347.  
  348.  
  349.  
  350.  
  351. ## ------------------------------------------------ ##
  352. ## firejail --net=eth0 --veth-name=eth0.vlan100
  353. ## ------------------------------------------------ ##
  354. ## net eth0
  355. ## veth-name eth0.vlan100
  356.  
  357.  
  358. ## ------------------------------------------------------------------------------ ##
  359. ## firejail --ip=192.168.1.68 --netmask=255.255.255.0 --defaultgw=192.168.1.1
  360. ## firejail --net=br0 --ip=10.10.20.5 --net=br1 --net=br2
  361. ## ------------------------------------------------------------------------------ ##
  362. ## ip 192.168.1.68
  363. ## defaultgw 192.168.1.1
  364.  
  365.  
  366.  
  367. ## ------------------------------------------------------ ##
  368. ##   [+] Acquire an IP address and default gateway
  369. ## ------------------------------------------------------ ##
  370. ##  [?] Firejail uses ISC dhclient DHCP client
  371. ##  
  372. ## ----------------------------------------------------------------------------- ##
  373. ##
  374. ##  ______________________________________________________________________
  375. ## |______________________________________________________________________|
  376. ##  |__DHCP Client__| |_DHCP-Server_| |_DHCP-Client_|   |__DHCP-Server___|
  377. ##    DHCP Discover --> DHCP Offer <-- DHCP Request -->  DHCP Acknowledge
  378. ##
  379. ## ----------------------------------------------------------------------------- ##
  380. ##
  381. ## ------------------------------------------------------ ##
  382. ## net br0
  383. ## ip dhcp
  384. ##
  385. ## ------------------------------------------------------ ##
  386. ##   [+] Acquire  an IPv6 address and default gateway from
  387. ## ------------------------------------------------------ ##
  388. ## net br0
  389. ## ip6 dhcp
  390. ## ------------------------------------------------------ ##
  391.  
  392.  
  393.  
  394.  
  395. ## -------------------------------------- ##
  396. ## interface eth0
  397. ## firejail --interface=eth0
  398. ## firejail --net=eth0 --ip=10.10.20.56
  399. ## -------------------------------------- ##
  400. ## mac $MacAddress
  401. ## firejail --mac=$MacAddress
  402. ## -------------------------------------- ##
  403. ## hostname $Hostname
  404. ## firejail --hostname=$Hostname
  405. ## -------------------------------------- ##
  406. ## iprange $IP,IP
  407. ## firejail --iprange=$IP,IP
  408. ## firejail --iprange=192.168.1.100,192.168.1.150
  409. ## -------------------------------------- ##
  410. ## netmask 255.255.255.0
  411. ## firejail --netmask=255.255.255.0
  412. ## -------------------------------------- ##
  413.  
  414.  
  415.  
  416. ## -------------------------------------------------------- ##
  417. ## /usr/share/doc/firejail/syscalls.txt
  418. ## -------------------------------------------------------- ##
  419. ## firejail --seccomp=@clock,mkdir,unlinkat transmission-gtk
  420. ## firejail --seccomp=unlinkat:ENOENT,utimensat,utimes
  421. ## -------------------------------------------------------- ##
  422. ## firejail --seccomp.drop=utime,utimensat,utimes,@clock
  423. ## firejail --seccomp.drop=unlinkat:ENOENT,utimensat,utimes
  424. ## -------------------------------------------------------- ##
  425. ## seccomp.drop $Syscall
  426. ## -------------------------------------------------------- ##
  427. ## firejail --seccomp.keep=poll,select transmission-gtk
  428. ## seccomp.keep $Syscall
  429. ## -------------------------------------------------------- ##
  430. ## seccomp-error-action ERRNO
  431. ## seccomp-error-action kill
  432. ## seccomp-error-action log
  433. ## -------------------------------------------------------- ##
  434. ## firejail --seccomp-error-action=kill
  435. ## firejail --seccomp-error-action=log
  436. ## firejail --seccomp-error-action=ERRNO
  437. ## -------------------------------------------------------- ##
  438. ## seccomp.block-secondary
  439. ## firejail --seccomp.block-secondary
  440. ## -------------------------------------------------------- ##
  441. seccomp
  442.  
  443.  
  444.  
  445.  
  446. ##-===============================================-##
  447. ##   [+] AppArmor Security Sandbox Confinement
  448. ##-===============================================-##
  449. ## ----------------------------------------------- ##
  450. ## apparmor
  451. ## firejail --apparmor
  452. ## ----------------------------------------------- ##
  453.  
  454.  
  455.  
  456. ##-=====================================-##
  457. ##   [+] enable AppArmor confinement
  458. ##-=====================================-##
  459. ## ----------------------------------------------------------------- ##
  460. ##  [?] AppArmor support is disabled by default at compile time.
  461. ## ----------------------------------------------------------------- ##
  462. ##  [?] Use --enable-apparmor configuration option to enable it:
  463. ## ----------------------------------------------------------------- ##
  464. ##  ./configure --prefix=/usr --enable-apparmor
  465. ##
  466. ##
  467. ## --------------------------------- ##
  468. ##  systemctl enable apparmor
  469. ##  systemctl start apparmor
  470. ##  /etc/init.d/apparmor start
  471. ## --------------------------------- ##
  472. ##
  473. ##
  474. ## ----------------------------------------------------- ##
  475. ##  [?] The AppArmor profile file (firejail-default)
  476. ##  [?] is placed in /etc/apparmor.d
  477. ## ----------------------------------------------------- ##
  478. ##
  479. ##
  480. ## ----------------------------------------------------- ##
  481. ##  [?] The local customizations must be placed in
  482. ## ----------------------------------------------------- ##
  483. ##  [?] /etc/apparmor.d/local/firejail-local
  484. ##
  485. ##
  486. ## ----------------------------------------------------- ##
  487. ##  [?] The profile needs to be loaded into the kernel
  488. ##      by reloading apparmor.service.
  489. ## ----------------------------------------------------- ##
  490. ##  service apparmor reload
  491. ##  /etc/init.d/apparmor restart
  492. ##  systemctl enable restart
  493. ##
  494. ##
  495. ##-===================================================================-##
  496. ##   [+] apparmor_parser - loads AppArmor profiles into the kernel
  497. ##-===================================================================-##
  498. ## apparmor_parser --verbose -r /etc/apparmor.d/firejail-default
  499. ##
  500. ##
  501. ##-===============================================-##
  502. ##   [+] Enforce all of the AppArmor profiles
  503. ##       in the /etc/apparmor.d/ directory:
  504. ##-===============================================-##
  505. ##  apparmor_parser --verbose -r /etc/apparmor.d/*
  506. ##
  507. ##
  508. ##
  509. ## ---------------------------------------------------------------- ##
  510. ##    [?] You may need to mount the securityFS into the kernel:
  511. ## ---------------------------------------------------------------- ##
  512. ##  mount -tsecurityfs securityfs /sys/kernel/security
  513. ##
  514. ##
  515. ## ------------------------------------------------- ##
  516. ##   [?] see if AppArmor is loaded and enabled
  517. ##   [?]         (should print “Y”):
  518. ## ------------------------------------------------- ##
  519. ##  cat /sys/module/apparmor/parameters/enabled
  520. ##
  521. ##
  522. ## ---------------------------------------------------------------- ##
  523. ##  cat /sys/kernel/security/apparmor/profiles
  524. ## ---------------------------------------------------------------- ##
  525. ##  cat /sys/kernel/security/apparmor/policy/profiles/
  526. ## ---------------------------------------------------------------- ##
  527. ##  cat /sys/kernel/security/apparmor/profiles | grep firejail
  528. ## ---------------------------------------------------------------- ##
  529. ##
  530. ##
  531. ##-======================================================================-##
  532. ##   [+] aa-status - report the current state of AppArmor confinement
  533. ##-======================================================================-##
  534. ##  sudo apparmor_status --verbose
  535. ##
  536. ##
  537. ##-========================================================================-##
  538. ##   [+] aa-complain - set an AppArmor security profile to complain mode
  539. ##-========================================================================-##
  540. ## ------------------------------------------------------------------------ ##
  541. ##  [?] In complain mode, the security policy is not enforced
  542. ##  [?] but rather access violations are logged to the system log.
  543. ## ------------------------------------------------------------------------ ##
  544. ##
  545. ## -------------------------------------------------- ##
  546. ##   [+] Place all of the apparmor profiles
  547. ##       in /etc/apparmor.d/* into complain mode:
  548. ## -------------------------------------------------- ##
  549. ##  sudo aa-complain /etc/apparmor.d/*
  550. ##
  551. ##
  552. ##-======================================================================-##
  553. ##   [+] aa-enforce - set an AppArmor security profile to enforce mode
  554. ##-======================================================================-##
  555. ##
  556. ## -------------------------------------------------- ##
  557. ##   [+] Place all of the apparmor profiles
  558. ##       in /etc/apparmor.d/* into enforce mode:
  559. ## -------------------------------------------------- ##
  560. ##  sudo aa-enforce /etc/apparmor.d/*
  561. ##
  562. ##
  563. ##-===============================================-##
  564. ##   [+] Enforce the Firejail AppArmor profile:
  565. ##-===============================================-##
  566. ##  sudo aa-enforce firejail-default
  567.  
  568.  
  569.  
  570. ## ------------------------------------------------ ##
  571. ##   [+]
  572. ## ------------------------------------------------ ##
  573. ##
  574. ## ------------------------------- ##
  575. ## caps.keep $Caps
  576. ## caps.drop $Caps
  577. ## ------------------------------- ##
  578. ##
  579. ## ------------------------------------------------------------------------------------------------------ ##
  580. ## firejail --caps.keep=chown,net_bind_service,setgid,setuid /etc/init.d/nginx start
  581. ## firejail --caps.keep=chown,sys_resource,net_bind_service,setuid,setgid /etc/init.d/apache2 start
  582. ## ------------------------------------------------------------------------------------------------------ ##
  583. caps.drop all
  584.  
  585.  
  586.  
  587. ## --------------------------------------------------- ##
  588. ##   [?] The sandbox is placed in g1 control group
  589. ## --------------------------------------------------- ##
  590. ## cgroup /sys/fs/cgroup/g1/tasks
  591. ## firejail --cgroup=/sys/fs/cgroup/g1/tasks
  592. ## --------------------------------------------------- ##
  593.  
  594.  
  595. ## ------------------------------- ##
  596. ##   [+] Enable IPC namespace
  597. ## ------------------------------- ##
  598. ## ipc-namespace
  599. ## firejail --ipc-namespace
  600. ## ------------------------------- ##
  601.  
  602.  
  603. ## ------------------------------------------------ ##
  604. ##   [+]
  605. ## ------------------------------------------------ ##
  606. ##
  607. ## ------------------------------- ##
  608. ## firejail --nonewprivs
  609. ## ------------------------------- ##
  610. nonewprivs
  611.  
  612.  
  613. ## ------------------------------------------------ ##
  614. ##   [+] Run program inside of a User_Namespace
  615. ## ------------------------------------------------ ##
  616. ## firejail --noroot
  617. ## ------------------------------------------------ ##
  618. noroot
  619.  
  620.  
  621. ## --------------------------------------------------- ##
  622. ##   [+]
  623. ## --------------------------------------------------- ##
  624. ## overlay
  625. ## firejail --overlay
  626. ## --------------------------------------------------- ##
  627. ## grep overlayfs /etc/firejail/firejail.config
  628.  
  629.  
  630.  
  631.  
  632.  
  633.  
  634. ## ----------------------- ##
  635. ##   [+] iptables.xml
  636. ## ----------------------- ##
  637. ##   [+] nolocal.net
  638. ## ----------------------- ##
  639. ##   [+] nolocal6.net
  640. ## ----------------------- ##
  641. ##   [+] webserver.net
  642. ## ----------------------- ##
  643.  
  644.  
  645. ## --------------------------------------------------- ##
  646. ## netfilter /etc/iptables/$File
  647. ## firejail --netfilter
  648. ## --------------------------------------------------- ##
  649. ## firejail --netfilter=/etc/iptables/$File
  650. ## firejail --netfilter=/etc/firejail/nolocal.net
  651. ## firejail --netfilter=/etc/firejail/nolocal6.net
  652. ## firejail --netfilter=/etc/firejail/webserver.net
  653. ## --------------------------------------------------- ##
  654. ## firejail --netfilter.print=
  655. ## firejail --netfilter6.print=
  656. ## --------------------------------------------------- ##
  657.  
  658.  
  659.  
  660. ## ------------------------------------------ ##
  661. ##   [+]
  662. ## ------------------------------------------ ##
  663. ## machine-id
  664. ## firejail --machine-id
  665. ## ------------------------------------------ ##
  666.  
  667.  
  668.  
  669. ## ------------------------------------------ ##
  670. ##   [+] Disable DVD and audio CD devices
  671. ## ------------------------------------------ ##
  672. nodvd
  673.  
  674.  
  675.  
  676. ## ------------------------------------------ ##
  677. ##   [+]
  678. ## ------------------------------------------ ##
  679. ##
  680. ## ------------------------------------------ ##
  681. noroot
  682.  
  683.  
  684. ## ------------------------------------------ ##
  685. ##   [+]
  686. ## ------------------------------------------ ##
  687. ##
  688. ## ------------------------------------------ ##
  689. notv
  690.  
  691.  
  692. ## ------------------------------------------ ##
  693. ##   [+]
  694. ## ------------------------------------------ ##
  695. ##
  696. ## ------------------------------------------ ##
  697. nogroups
  698.  
  699.  
  700.  
  701. ## ------------------------------------------ ##
  702. ##   [+]
  703. ## ------------------------------------------ ##
  704. ##
  705. ## ------------------------------------------ ##
  706. ## timeout hh:mm:ss
  707. ## firejail --timeout=hh:mm:ss
  708. ## ------------------------------------------ ##
  709. ## firejail --timeout=01:30:00 firefox
  710. ## ------------------------------------------ ##
  711.  
  712.  
  713. ## ------------------------------------------------ ##
  714. ##   [+]
  715. ## ------------------------------------------------ ##
  716. ## firejail --shell=none
  717. ## firejail --shell=/bin/dash script.sh
  718. ## ------------------------------------------------ ##
  719. shell none
  720.  
  721.  
  722. ## ------------------------------------------------ ##
  723. ##   [+]
  724. ## ------------------------------------------------ ##
  725. ## firejail --protocol=unix,inet
  726. ## ------------------------------------------------ ##
  727. protocol unix,inet,netlink
  728.  
  729.  
  730.  
  731.  
  732. ## ------------------------------------------------ ##
  733. ##   [+]
  734. ## ------------------------------------------------ ##
  735. ## net none
  736. ## firejail --net=none vlc
  737. ## firejail --protocol=unix,inet
  738. ## ------------------------------------------------ ##
  739.  
  740.  
  741.  
  742. ## ------------------------------------------------ ##
  743. ##   [+]
  744. ## ------------------------------------------------ ##
  745. ## tracelog
  746. ## firejail --tracelog
  747. ## firejail --trace
  748. ## firejail --trace $Program
  749. ## ------------------------------------------------ ##
  750.  
  751.  
  752.  
  753. ## ------------------------------------------------ ##
  754. ##   [+]
  755. ## ------------------------------------------------ ##
  756. ## read-only ${HOME}
  757.  
  758.  
  759.  
  760. ## ------------------------------------------------ ##
  761. ##   [+]
  762. ## ------------------------------------------------ ##
  763. noexec /tmp
  764. noexec ${HOME}/
  765.  
  766.  
  767.  
  768.  
  769. ## ------------------------------------------------ ##
  770. ##   [+]
  771. ## ------------------------------------------------ ##
  772. disable-mnt
  773.  
  774.  
  775.  
  776.  
  777. ## ------------------------------------------ ##
  778. ##   [+]
  779. ## ------------------------------------------ ##
  780. ## firejail --private
  781. ## firejail --private=$Dir
  782. ## firejail --private-home=$Dir
  783. ## ------------------------------------------------ ##
  784. ## firejail --private=/home/$User/firejail-home
  785. ## firejail --private-home=.mozilla firefox
  786. ## ------------------------------------------------ ##
  787. ## private
  788.  
  789.  
  790.  
  791. ## ------------------------------------------ ##
  792. ##   [+]
  793. ## ------------------------------------------ ##
  794. ##  firejail --private-dev
  795. ## ------------------------------------------ ##
  796. private-dev
  797.  
  798.  
  799. ## ------------------------------------------ ##
  800. ##   [+]
  801. ## ------------------------------------------ ##
  802. ##  firejail --private-cache
  803. ## ------------------------------------------ ##
  804. private-cache
  805.  
  806.  
  807. ## ------------------------------------------ ##
  808. ##   [+]
  809. ## ------------------------------------------ ##
  810. ##  firejail --private-etc=
  811. ## ------------------------------------------ ##
  812. ## private-etc alsa,alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,localtime,machine-id,os-release,pki,pulse,resolv.conf,ssl,xdg
  813.  
  814.  
  815.  
  816.  
  817. ## ------------------------------------------ ##
  818. ##   [+]
  819. ## ------------------------------------------ ##
  820. ## firejail --private-tmp
  821. ## ------------------------------------------ ##
  822. private-tmp
  823.  
  824.  
  825.  
  826. ## ------------------------------------------ ##
  827. ##   [+]
  828. ## ------------------------------------------ ##
  829. ##
  830. ## ------------------------------------------ ##
  831. ##
  832. ## ----------------------------------------------------------------- ##
  833. ## firejail --dbus-user=none
  834. ## firejail --dbus-user=filter --dbus-user.log
  835. ## firejail --dbus-user=filter --dbus-user.own=org.gnome.foo.*
  836. ## ----------------------------------------------------------------- ##
  837.  
  838.  
  839.  
  840. ## ------------------------------------------ ##
  841. ##   [+]
  842. ## ------------------------------------------ ##
  843. ## memory-deny-write-execute
  844.  
Tags: debian firejail apparmor sandbox ParrotSec
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!