3

In Ubuntu 19.04, you can install Chromium using snap like this:

sudo snap install chromium

However, when installing Chromium via snap, you cannot sandbox it with firejail like this:

firejail chromium-browser

The command above runs the non-snap version of chromium in a sandbox where chromium only has access to the Downloads folder (and not your entire home folder).

However, when Chromium is install as a SNAP, firejail cannot achieve these file system restrictions. When you use Chromium installed via sudo apt install chromium-browser, firejail works, but it doesn't work with snap-installed chromium.

I understand that future versions of Ubuntu will only be offering the snap package of Chromium, so that's why I'm trying to address this issue right now in Ubuntu 19.04. See this as well.

I've requested an alternative snap installation method, that only gives Chromium access to the Downloads folder here.

Until then, how can I sandbox Chromium (installed via SNAP), in a manner like firejail sandboxes Chromium (installed via apt)?

  • 3
    Snap apps should already be sandboxed, but I guess you could try to run them through firejail, if you like. Snap's executables are installed in /snap/bin, so try firejail /snap/bin/chromium-browser. – ajgringo619 Oct 6 '19 at 1:27
  • The snap for Chromium is sandboxed to a degree, but not to the degree I want. How can I control exactly what portions of the file system the installation has access to? firejail /snap/bin/chromium-browser doesn't work. – Lonnie Best Oct 6 '19 at 1:35
  • 1
    Look here: snapcraft.io/docs/interface-management – ajgringo619 Oct 6 '19 at 1:37
  • @ajgringo619 : That looks like a good start. I was able to disconnect the ability to access the home folder, but I'm now trying to figure out how to enable access to the Downloads folder exclusively. – Lonnie Best Oct 6 '19 at 1:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.