40
Sandboxing Applications using Bubblewrap
Bubblewrap at a glance
- Sandbox is defined via command line options
- Starts with an empty filesystem, host paths are opt-in
NO_NEW_PRIVSbit is set- Allows also isolating other namespaces such as networking
Example: Allow everything, but /mnt
$ bwrap --bind / / --tmpfs /mnt /bin/sh
Bubblewrap (bwrap) is a lightweight sandboxing tool for Linux that creates isolated environments by unsharing namespaces, restricting filesystem access, and limiting privileges. It is commonly used to enhance security by confining applications, such as Flatpak packages, to prevent them from affecting the host system. In the comments section, a more advanced example is linked, which shows how to restrict filesystem access for the Firefox browser.
Link for comments: https://gist.github.com/richardweinberger/cae9edeafeec4cdf657f9bdae00be241
Get in touch
sigma star gmbh
Eduard-Bodem-Gasse 6, 1st floor
6020 Innsbruck | Austria
