running AppArmor and Firejail together

[ThatNewDude]

Is there any downside to running these apps together for TB? In a couple forums it was mentioned that running them together could cause them to not function properly. But those were older posts by individuals, not any kind of coding authority, so I thought I would ask. Thanks

[madaidan]

Tor Browser Hardening (hardened malloc, firejail, apparmor) vs Web Fingerprint

I highly doubt the fingerprint would be much different with the hardening enabled, if at all. The sandboxing shouldn’t be visible to websites as it doesn’t affect anything internally. hardened_malloc might change the fingerprint (you can see differences in about:memory) but I doubt websites can detect this. The warning with the sandboxed-tor-browser project is likely because that sandboxing was part of the actual browser and not some external thing like firejail. I also think we should be usi…

firejail / seccomp / More Options for Program Containment

apparmor vs firejail Quote @Vincent43 I would say that firejail regularly causes issues for apps confined with standalone AppArmor profiles and the other way around. In essence they are blocking each other from functioning. In effect you would need to weaken both firejail and apparmor profiles which makes the sense of running them both questionable. Interesting. Not yet sure that should be believed. There isn’t much technical explanation. And I don’t know it can be taken as an authoritative…

[ThatNewDude]

Yeap, that was the github discussion I was referencing. It was from last year. I just was wondering if there had been a more definitive discussion on using both apps together. Thanks for linking to the more recent discussion.

[madaidan]

@ThatNewDude

Yeap, that was the github discussion I was referencing. It was from last year.

What? That github discussion was from 15 days ago.

[ThatNewDude]

the github “netblue30/firejail/issues/2248” thread (November 2018)

Question: Firejail vs using Apparmor only? What are some the advantages

[Patrick]

@ThatNewDude

But those were older posts by individuals, not any kind of coding authority,

I don’t think an authoritative statement can be produced here at Whonix forums either since no posters here are known to have been involved with either kernel, apparmor or firejail development.

See if
libpostexecseccomp.so in /run/firejail/lib/libpostexecseccomp.so apparmor issue · Issue #2947 · netblue30/firejail · GitHub
gets an authoritative statement.

Self Support First Policy for Whonix applies.

[ThatNewDude]

I was just wondering if there was any new information that could lead to a recommendation on whether to use Firejail and AppArmor together for the Tor Browser? Thanks

[Patrick_mobile]

firejail / seccomp / More Options for Program Containment

There was technical elaboration in the same ticket. Vincent43: AppArmor sandbox is path based and uses whitelist approach by default. Firejail sandbox is also path based and uses blacklist approach by default. It also uses namesapces and rewrites some paths in sandbox which cause denials in AppArmor as you can see. The only case supported by firejail related to AppArmor is using firejail-default generic profile which shouldn’t cause issues. Users who want to use app specific profiles with fir…