Date: Mon, 19 Jul 2021 05:23:09 -0500 (CDT)
From: Ariadne Conill <ariadne@dereferenced.org>
To: ml-devel@keemail.me
cc: ~alpine/users <~alpine/users@lists.alpinelinux.org>
Subject: Re: Firejail
In-Reply-To: <MextMId--3-2@keemail.me>
Message-ID: <5eec4fc-291d-1aae-dac-4776cba0945b@dereferenced.org>
References: <MexPCzM--3-2@keemail.me> <87c4c1c0-f20-3f9-2a6-a85c9a4b2133@dereferenced.org> <MextMId--3-2@keemail.me>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII; format=flowed

Hi,

On Mon, 19 Jul 2021, ml-devel@keemail.me wrote:

> Jul 19, 2021, 07:26 by ariadne@dereferenced.org:
> 
> > `firejail` has a rather problematic design, so we dropped the package as we were not confident in its dependability as a security tool.
> 
> The main reason I use Firejail is because it has a simple front-end. For instance, if I don't want an application to see the contents of my local filesystem, I could simply use the `--private` flag. I
> could use `--net=none` to prevent the application from accessing the network. Firejail also has extensive documentation, which makes it easy to figure things out.
> 
> I understand that one shouldn't rely solely on Firejail for security/privacy, although I think it's a great tool to have in the arsenal. I would like to request the re-addition of Firejail into the
> official repositories.

Unfortunately, the SUID nature of firejail is sufficiently problematic 
that it won't return until there is a way to run firejail without being 
SUID.

> > I'm not familiar with the modifications made to Firefox with tor-browser, but you should be able to just use Firefox with Tor directly, I think.
> 
> Yes, I could do this. Although Tor provides additional anti-fingerprinting measures, which Firefox doesn't provide by default.
> 
> Also, I noticed that `apparmor` is still in in the testing repository. How unsafe is it to run your systems, especially production-facing ones, without `apparmor`? Is there an alternative that's
> currently provided?

It is perfectly safe to run your systems without AppArmor or SELinux. 
These systems just provide mechanisms for building and loading policy 
statements into the kernel.  The normal UNIX security primitives, while 
not as advanced, are sufficient for the majority of production Alpine 
systems.

With that said, there is some interest amongst some developers to make 
AppArmor a first-class citizen in Alpine 3.15, but it's still early days 
of that effort, so we'll see how it plays out.  I think it would be nice 
to have, but I sleep well at night without it.

> "All userland binaries are compiled as Position Independent Executables (PIE) with stack smashing protection. These proactive security features prevent exploitation of entire classes of zero-day and
> other vulnerabilities."
> 
> I am not sure what the above lines mean. Does PIE, in a way, function as a kind of alternative to apparmor?

AppArmor is a policy framework, PIE is a way of compiling programs to make 
them have a more randomized address space layout.  They are unrelated to 
each other.

Ariadne