Firejail
Firejail 0.9.80 is a Linux sandbox using namespaces, seccomp-bpf, capabilities and optional AppArmor or SELinux rules to limit an application's files, network and process resources.
What Firejail provides
Firejail adds lightweight restrictions around Linux applications through namespaces, seccomp-bpf, capabilities, cgroups and optional AppArmor or SELinux integration. Profiles can reduce visible files, devices, network paths and processes for browsers, media players, downloaders and desktop tools.
Shared-kernel and SUID boundaries
Firejail is not a virtual machine; the sandboxed process still shares the host kernel and any display, audio, IPC, device or network paths allowed by its profile. It is also a SUID security component, so version and profile errors can expand risk. Use updated packages, explicit application paths and a separate test account for profile changes.
Verification and profiles
A profile is a baseline, not proof that every application action is safe. Inspect the active mounts, capabilities, seccomp state, network and profile source, then test both required features and rejected access. Review date: 2026-08-23.
Save to your cloud drive
Open the cloud drive to get the file directly, or save it for convenient access on another device.
Quark Cloud Drive
RecommendedSave Firejail to this cloud drive
Baidu Netdisk
Save Firejail to this cloud drive
Firejail 0.9.80 profile review and least-privilege guide
Test a normal application with its profile, verify files and network visibility, and adjust one rule at a time instead of globally wrapping every desktop program.
Before you start
- Use a supported Linux kernel and Firejail 0.9.80, checking whether a distribution package lags behind the maintained release.
- Prepare an ordinary user, a test application and a directory without sensitive data; keep AppArmor or SELinux enabled when available.
- Record the files, display, audio, devices and network destinations the application genuinely requires.
Installation steps
- 01
Install a current package
Use the x86_64 DEB or a maintained distribution package, or build from verifiable source, then check the installed version and package ownership.
- 02
Inspect SUID and integration
Verify owner, mode and distribution security policy, and postpone global firecfg integration until a profile has been tested.
- 03
Use an explicit application path
Run as a normal user with the full or relative application path and review the selected profile rather than relying on an ambiguous executable name.
Quick start
- 01
Inspect the active sandbox
Check mounts, capabilities, seccomp, network state and profile source after launch; the presence of the firejail command alone is not sufficient evidence.
- 02
Test minimum file and network scope
Verify that sensitive home paths are hidden, allow only required directories, disable network access when unnecessary and restrict destinations when it is needed.
- 03
Adjust one rule at a time
Use denial logs to widen a single rule with a recorded reason, then repeat tests after an application update instead of allowing an entire home directory.
Usage tips
- Shared kernel, display services, audio sockets and allowed IPC remain part of the boundary; combine Firejail with patching and stronger isolation for high-risk samples.
- Global desktop integration changes normal launch paths and should follow an audit, not be the first troubleshooting step.
- Old profiles can become unsafe or silently incomplete after application updates, so retest them on every major change.
Troubleshooting and uninstall
Why can the sandboxed app not open a file or play audio?
Review deny, private, whitelist and desktop-service rules, including symlink targets, then grant only the required path or socket and retest.
What if the distribution has only an old package?
Compare the upstream support matrix with distribution backports, request an update and use a traceable current package if a separate installation is required.
- Revert desktop integrationIf firecfg was used, restore its launch links and integration, confirm the original application path works and remove custom profiles that are no longer required.
- Remove package and residual privilegesUninstall Firejail, inspect SUID files and AppArmor or SELinux rules, and remove private directories only after the audit records are retained.
Frequently asked questions
Does Firejail isolate a hostile program like a virtual machine?
No. It shares the host kernel and profile-approved services. Use a separate host or virtual machine for high-risk samples and combine controls with patching and stronger isolation.
Does an existing profile make an application safe automatically?
No. Profiles are general baselines and may be too broad or too strict after updates. Verify mounts, permissions, network and rejected actions for the exact build.
Does the download require an extraction code?
The Quark entry does not require one; the four-character code for the Baidu entry is shown beside its download entry.