0

I want some functionality like Sandboxie on Windows.

That is, I want to run a program in a sandbox. The program doesn't detect the sandbox, and can read files from outside the sandbox usually. But when the program attempts to write files, the files are only written in the sandbox, not outside. And then, possibly outside the sandbox, I want some way to see only the files created inside the sandbox.

I read Installing Sandboxie on ubuntu but it doesn't seem to be what I want.

According to http://www.linux-magazine.com/Issues/2015/173/Firejail, Firejail has an overlay feature, but the files are destroyed when the program which creates them ends. Instead, I want to inspect these files.

It seems these overlay things are part of Linux since kernel 3.18, not sure if there is some way to use them to achieve what I want.

I have Lubuntu 16.04.1 with linux kernel 4.4.0-53-generic.

Improve this question

2 Answers 2

Reset to default
4

Firejail can be configured to use a "whitelist" of files allowed to be kept, which would allow you to use it without the files you want to keep being deleted. If you simply want to see what files would be written you can also read the logs.

https://firejail.wordpress.com/features-3/man-firejail/

   --read-write=dirname_or_filename
          Set  directory  or  file  read-write.  Only files or directories
          belonging to the current user are allowed  for  this  operation.
          Example:

          $ mkdir ~/test
          $ touch ~/test/a
          $ firejail --read-only=~/test --read-write=~/test/a

Running apps within Docker will be a much complicated situation and won't work unless they are command-line applications since there is no graphic server sharing without additional configurations. Also docker is more designed to help these individual containers talk to each other, something you haven't said you needed (and likely don't need in this sandboxing model)

Improve this answer
3
  • So I would need something like sudo firejail myprogram --read-write=/? (I guess / belongs to root). Where are these files stored?
    – Oriol
    Dec 11, 2016 at 23:16
  • 1
    Don't run firejail (or any other programs) as root unless you have a reason to. You should run firejail as a regular user without sudo. For --read-write you will probably want to create a directory in your home directory and point it to that then run that program inside there, like this: mkdir ~/mywork; cd ~/mywork; firejail --read-write=~/mywork myprogram; Also take note that the way you passed your arguments they would have been given to myprogram and not firejail, the order matters since arguments can also be passed to myprogram.
    – Kristopher Ives
    Dec 11, 2016 at 23:21
  • I use firejail --overlay and then the programs I run in the console write the files to ~/.firejail/<num>/odiff/. Seems exactly what I want.
    – Oriol
    Dec 11, 2016 at 23:34
0

You could use docker containers for this. Docker containers are name-branded old LXC containers that were called BSD jails long ago. Use docker containers and their volume mounting feature so that you can inspect data afterwards and save it.

Improve this answer
5
  • How can I use docker containers? By installing docker.com?
    – Oriol
    Dec 11, 2016 at 22:52
  • Should be able to install docker by doing 'sudo apt-get install docker'. Then look at all the commands you can do with 'docker help'. I've been working with them extensively recently.
    – Kyle H
    Dec 11, 2016 at 22:53
  • I tried but seems too hard. Do you know any program with a nice GUI which does this for me?
    – Oriol
    Dec 11, 2016 at 23:10
  • Docker requires a PPA as they are constantly releasing new versions which break the previous version. Any version you find in the standard repos will be very old by docker standards.
    – Kristopher Ives
    Dec 11, 2016 at 23:13
  • It would still work for his purposes. I disagree that each version breaks the old.
    – Kyle H
    Dec 12, 2016 at 14:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .