Is it not possible make firejail available for FreeBSD too?

[firejailaddssecuirty]

Besides Linux I also started using GhostBSD which is based on FreeBSD. Its been only a few days so I don't much about FreeBSD but I found they have Jails for isolation but that's too resource consuming.

Is it not possible make firejail available for FreeBSD too ?

[rusty-snake]

Is it not possible make firejail available for FreeBSD too ?

If you start FreeBSD with a Linux Kernel, you can start using firejail 🙃 .

[firejailaddssecuirty]

Okay. Sorry I didn't know that firejail is dependent mainly on the Linux kernel to do what it does. I am just an average home desktop user.

[topimiettinen]

The long answer is that Firejail depends on:

• mount namespaces and bind mounts
• network namespaces
• seccomp (BSD BPF filtering applied to system call interface)
• capabilities (like BSD securelevel but fine grained and per-process)

Especially mount namespaces and bind mounts are critical to construct a restricted view of file system specific for the app. The other features aren't so essential but of course all of them improve security by limiting the attack surface.

Jails seem to provide chroot-like functionality with respect to file systems, but it's also possible to construct further sub-jails etc. The network support seems loosely similar to Firejail's. I don't think there are equivalents of seccomp or capabilities.

So, FreeBSD should implement bind mounts and mount namespaces and I'd highly recommend seccomp too. Capabilities in Linux aren't very well designed, so while the general idea could be reused, please avoid CAP_SYS_ADMIN.

Even if the features are developed, it may still be more useful to extend Jails rather than port Firejail, though I suppose the app profiles could be reused on FreeBSD (assuming that the directory layout is the same and stuff like D-Bus is also used).

[firejailaddssecuirty]

Learned a lot. Thanks.