Posted: 2017-03-22 23:15:59 by Alasdair Keyes
I recently had some problems with some software on my laptop calling home and receiving an invalid response, this then caused the software to stop working correctly. Until this is resolved, I really want to keep on using the software. After testing in a VM with the network disabled, I realised that if it was unable to call home then it continued to work correctly.
A Virtualbox VM works fine and with the Vbox tools installed I have bi-directional copy/paste etc but it's not an elegant solution and the VM overhead is much greater than the native application.
From this I found out about the
firejail tool. This is shipped in the standard Ubuntu repos and provides a great deal of sandboxing utilities that I was unaware of.
For me the
--net=none argument was suitable. This creates a new unconnected network namespace before executing the app and restricting it's network access to localhost only.
$ firejail --net=none mytroublesomeapp
This is incredibly useful and a tool I will be making much more use of in future.
If you wish to test, try some of the following.
firejail --net=none firefox firejail --net=none ping google.co.uk
The man pages show what other options are available too. It's well worth a look
If you found this useful, please feel free to donate via bitcoin to 1NT2ErDzLDBPB8CDLk6j1qUdT6FmxkMmNz
I'm now available for IT consultancy and software development services - Cloudee LTD.
Happy user of Digital Ocean (Affiliate link)