Delimitate execution permissions for firejail #5288
Labels
documentation
Issues and pull requests related to the documentation
Projects
Comments
|
How is your suggestion different from firejail.users and Create a special firejail group? |
|
Thank you. I think if you mention the file in man firejail somewhere in top, it would be much easier no notice. But it's off topic, so closing the issue. |
kmk3
added
question_old
kmk3
added a commit
to kmk3/firejail
that referenced
this issue
Aug 3, 2022
People might assume (and have assumed) that firejail can be executed by any user by default, which makes the SUID issue seem more encompassing than it is. So on the introduction of firejail(1), mention the main risk of SUID binaries and that by default, only the root user is allowed to run firejail (and also how to allow more users). Suggested by @emerajid on netblue30#5288. Relates to netblue30#4601.
kmk3
removed
the
question_old
kmk3
added a commit
to kmk3/firejail
that referenced
this issue
Aug 5, 2022
On the introduction of firejail(1), mention the main risk of SUID binaries and that by default, only trusted users should be allowed to run firejail (and how to accomplish that). Note: The added comment line is completely discarded (so there is no extraneous blank line); see groff_man(7) for details. Suggested by @emerajid on netblue30#5288. Relates to netblue30#4601.
kmk3
changed the title
kmk3
added a commit
that referenced
this issue
Aug 18, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Problem: According to what I hear, firejail is targeted at single-user systems. Partly because of not knowing this, many people complain about firejail being a huge bulk of suid code. Personally I think (and therefore write this issue) that single-user design is a pity, because even regular users may have situations where they need to share their laptop.
Solution I'd like: Do what sudo does. Simple accessible only by root file with declarative syntax defining which users are allowed to use firejail. I would even suggest allowing users to turn on authorization in case they feel something very unexpected might happen.
If I propose futile feature, I would dearly like to know why, since I'm not much of a developer.
The text was updated successfully, but these errors were encountered: