About

User home directory as seen by Mozilla Firefox browser process

Written in C with virtually no dependencies, the software runs on any Linux computer with a 3.x kernel version or newer. The sandbox is lightweight, the overhead is low. There are no complicated configuration files to edit, no socket connections open, no daemons running in the background. All security features are implemented directly in Linux kernel and available on any Linux computer. The program is released under license.

Firejail can sandbox any type of processes: servers, graphical applications, and even user login sessions. The software includes security profiles for a large number of Linux programs: Mozilla Firefox, Chromium, VLC, Transmission etc. To start the sandbox, prefix your command with “firejail”:

$ firejail firefox                       # starting Mozilla Firefox
$ firejail transmission-gtk              # starting Transmission BitTorrent 
$ firejail vlc                           # starting VideoLAN Client
$ sudo firejail /etc/init.d/nginx start  # starting nginx web server

Firejail Introduction – Aaron Jones,

We offer two Firejail flavors (mainline and long term support) and a number of additional sandbox plug-ins.

• Mainline is our latest and greatest sandbox version. It includes new features and developments, updated profiles, and support for the latest desktop applications. The target audience is desktop home users. ()
   


• Long Term Support (LTS) – Every two or three years we cut a branch from mainline git, we remove rarely used features (chroot, overlay, rlimits, cgroups, etc.), incomplete features (private-bin, private-lib, etc.), and a lot of instrumentation (build profile feature, tracing, auditing, etc). Sandbox-specific security features such as seccomp, capabilities, filesystem whitelist/blacklist and networking are updated and hardened. LTS receives periodic security updates, but no new features are ever added. The end result is a more stable software base, and a much smaller attack surface. Please use this version for any kind of enterprise deployment. ()
   


• is the graphical user interface of Firejail. The application is built using Qt4/Qt5 libraries. It provides a sandbox launcher integrated with the system tray, sandbox editing, management and statistics. (, )
   


• is a DNS over HTTPS (DoH) proxy server. FDNS protects your computer against some of the most common cyber threats, all while improving the privacy and the system performance. We use only DoH services from non-logging providers, while preferring small operators such as open-source enthusiasts and privacy-oriented non-profit organizations. (, )
• Firetunnel allows the user to connect multiple Firejail sandboxes on a virtualized Ethernet network. Applications include virtual private networks (VPN), overlay networks, peer-to-peer applications. Currently the project is in beta-testing phase, you can find out more on our page.
   

Firejail is a community project. We are not affiliated with any company, and we don’t have any commercial goals. Our focus is the Linux desktop. Home users and Linux beginners are our target market. The software is built by a large international team of volunteers on . Expert or regular Linux user, you are welcome to join us!

March 2020 – documentation:

March 2020 – released FDNS 0.9.62.4. In this release we introduce , , SNI cloaking whenever possible, we disable all known DoH service on the local network, and we increased DNS cache TTL to 40 minutes. Also bugfixes and a DoH server list update.

Feruary 2020 – released FDNS 0.9.62.2. The project is feature-complete! We added over 60 new DNS over HTTPS servers, documentation, an automated test framework, and lots of bugfixes. You can find the project .

December 2019 – released Firejail 0.9.62 () with a number of new features, additional SUID hardening, lots of bugfixes, and a large number of new applications supported by default. Basically, during 2019 we doubled the number of default apps, and we stand now at 884. This number will go way up in 2020. Happy New Year! ().

additional hardening, a small number of new features

December 2019 – released Firetools 0.9.62 (). In this release we introduce support for Firejail DNS over HTTPS proxy server (), a separate system tray icon to control the stats application, the network statistics were enhanced and split out in a separate window, support for our Firejail LTS release, and a number of bugfixes. ()

We also have a new webpage for the project at .

December 2019 – We are proud to announce a new addition to the Firejail family of security tools: Firejail DNS over HTTPS proxy server.

Targeted at small networks and Linux desktops, the proxy adds strong encryption and authentication on top of the regular DNS protocol. You can run it as a regular DNS server for a network of computers, or as a plug-in for your Firejail sandboxes. The software is written in C, and is licensed under GPLv3.

June 2019 – released Firejail 0.9.56.2-LTS (). This a regular bugfix-only release for our LTS branch (). This version also fixes two security issues, details .

May 2019 – released Firejail 0.9.60 (). This release brings in a several new features, lots of new application profiles, bugfixes and general SUID hardening (). This version also fixes two security issues, details .

February 2019 – released Firejail 0.9.58.2 (). In this release we are fixing a number of bugs introduced by 0.9.58. .

January 2019 – released Firejail 0.9.58 (). This is a maintenance release including bugfixes and security profile updates for over 600 Linux applications. .

January 2019 – released Firetools 0.9.58 (). .

October 2018 – released Firejail LTS 0.9.56 (). We are rebasing our Long Term Support branch of Firejail. The previous LTS version (0.9.38.x) is more than two years old. The new version updates the code base to 0.9.56. We target a reduction of approx. 40% of the code by removing rarely used features (chroot, overlay, rlimits, cgroups), incomplete features (private-bin, private-lib), and a lot of instrumentation (build profile feature, tracing, auditing, etc). Sandbox-specific security features such as seccomp, capabilities, filesystem whitelist/blacklist and networking are updated and hardened. .

September 2018 – released Firejail 0.9.56 (). New features: wireless interface support for –net command, tunneling support (TAP device support in –net command), temporary filesystem support for /home/user/.cache directory (–private-cache), support for U2F devices, additional hardening of SUID executable, and much more. .

May 2018 – released Firejail 0.9.54 (). This release includes a number of new features and new profiles. Firefox 60 problems seem to be fixed for now. Trying to mitigate the concerns about Firejail being an SUID application, we introduce . This is basically a list of users that are allowed to use the sandbox. The list is located in /etc/firejail/firejail.users file. After updating to the new version you should execute sudo firecfg which not only applies the newly introduced profiles but also adds the current user to the database. .

March 2018 – released Firetools 0.9.52 (). In this release we switch to a more pleasant grayscale color scheme, we introduce a number of small enhancements, and regular bugfixes. .

Firejailed!

Page 2

Try installing Firejail from your system packages first. Firejail is included in Alpine, ALT Linux, Arch, Chakra, Debian, Deepin, Devuan, Fedora, Gentoo, Manjaro, Mint, NixOS, Parabola, Parrot, PCLinuxOS, ROSA, Solus, Slackware/SlackBuilds, Trisquel, Ubuntu, Void. You can also install one of the , or clone Firejail’s source code from our .

After install run sudo firecfg in a terminal. The command integrates Firejail into your desktop. You will be able to start your sandboxed applications by:

• clicking on the app icon in your window manager menus


• clicking on a file in the file manager will automatically sandbox the application opening the file


• no need to prefix your application with firejail when starting in command line

Download the source code archive and extract the files:

Compile and install

AppArmor support is not enabled by default at compile time. It is also missing from the binary packages we distribute on this site. Add “–enable-apparmor” in configure command to include this support:

You can find more AppArmor information in our document.

Firetools compilation is described .

Firejail’s source code is hosted in a repository on GitHub. You can access and compile it with the following commands:

For each release we provide a firejail-X.Y.Z.asc file that contains SHA256 checksums for each archive released. You can check the checksum using sha256sum utility from package.

firejail-X.Y.Z.asc file also includes a signature. You can check the integrity of the file using our public key below. We use this key across all Firejail-related projects.

mQENBFRaIzYBCACvfLk+0CpSK+03h0svI3XfbSuGppB1jSd70QoX6jgjcJ6ble+G
V8gQEd8hU6Rhw4oa6klY+sVY2Si+7ZLaGQAiucERNG0aJA23gYVw91OyaARNZ1SZ
8Ju7GowCxLOT6Ie8RyWCCv1yXGxQT36j2I1Z9/UvYHvIJISZ48K4Dk8OuF5lcCH7
jN5X/7pqhmBKKx3Ve4UWmiKjisZcEdhJ9U5nyrHNSngPYSia+YIK/wG4nqY3ooZi
HvLA21HeaVBaILmRuRCO7akqxFB9SfJTHDqC0czZ0/3NJ3AyQv/qEkIkxGOHogKx
hNqGUBxYhba9Hl9Sl3IX72aQ28CxUngpXLNJABEBAAG0LG5ldGJsdWUgKGZpcmVq
YWlsIGtleSkgPG5ldGJsdWUzMEB5YWhvby5jb20+iQE4BBMBAgAiBQJUWiM2AhsD
BgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRAsyzat/FhJp7daB/0UlljRMtJ7
/Ht9gDcQm1pqsShGw29QtLSxDWV7A250GdveGNs2yZTCJQIyoK1Pa+Q5GOUwv0I2
VOxqTgnG3j1pCtcCbb7rkRQa6dix71IgKG+F4wUlWLdgaVsH7h1MtVobZ+nNSQAY
Bl+9vd9cKuyIYI+e6pdlLP/yCT78ehI/wVDD2V/w3ixnvnSLIgoRQRX9gAbRIf3i
/cXpyVn7wLYNMUwBrH3hPDTJPTdNih75ZcMMBWDnkt+IMijtxM++4J+45odoPKb6
bCvq0e0WtWmscOx/jN5cgOyC/87lcQuHSyjiSJowJzJUnO0sL9r1X1RFsU+XhGfN
8Ml/9flP/ojYuQENBFRaIzYBCADCE9S6rB7FI4z07H0PZ97XKh5U7r5hIxWrt1nC
yzD/Hprfy9ZZRJklAa+XlMMIPHHv3h8JEL2B5TWKxCa7KbNYfoLoLGywp6aIw6+X
kDhKXesEDN5WFUCW186hlmEExgNpOGZlbBLqJnaFfxhunSGgdHd5YHiASkts5Uwd
zzo2uFMcn0q0HlLLGAVwI787P6xAsAvgf4BCFuc4XGCWl8XDQbChZ8LC/ovHPq4Q
H8g6cIzya6f5E/VT2+dYGpME0bPmjTm0ZzvTHWfjw+B2d5AO5mNQiewHejnPxrcq
qJkO+Y6S80R/JPfmOI3RCHcoyB+QJ1I2I4yQ6G5dFwKl/IknABEBAAGJAR8EGAEC
AAkFAlRaIzYCGwwACgkQLMs2rfxYSad2pAf8CaKsDD1yj1mvYcUX1chrUlYmZVuR
PSFKf90OETlGSCYqdi4yyeJJnis4HBDcGPa+hFpLVksJlRCKqKQiqjndaNHhRgyM
ZouoeJvBiwCdwpQmZHgpgTv1V8n4PJ4anqISC5/ZGN9HDJ68gDx2hzeuilc+6umK
E99f7Qo8rdaeu5IGhujQhxnemAyTBNGZh3tABZcni5m7uVJKihdDUogghXSnIBxh
ilSqRQrPqyCjic8MUB9S+eBQC4Z67i9YqJaBfb80x9HqINLncGFDHKIajwy8f7Sh
k67z733GYXrAnyHsia4IF4UGRLW4+1xtKE9xmUThmwMdkgqtJ9eqBpAF9A==
=/BT3

-----END PGP PUBLIC KEY BLOCK-----