Linux is new on my pc. I would like know, if you have detailed instructions on how to activate appamor for my LibreWolf browser in Linux LMDE 7?
apparmor comes with several profiles, and if in your distro it doesn’t include one for librewolf, you can use the firefox one. And if there’s no available one and you would be interested in combine it with firejail then most probably firejail will come with with a profile for firefox or librewolf and usually with support for apparmor. Regardless of the distros, the arch wiki can guide you with apparmor and firejail. I recommend becoming familiar with both. Another option if there’s no profile on your distro is to look into another distro’s profile. ubuntu used include some software with apparmor out of the box so perhaps it’s a good source of profiles…
Also in this same community there’s an old post precisely about what you’re asking for, though it’s a bit dated, you may want to scroll for some time until getting to it.
Edit:
Firejail is insecure, my bad. Better to use bubblewrap (I didn’t know about bubblejail). The thing is that firejail offers profiles combined with apparmor which might have solved the lack of apparmor profiles. For my personal purposes I hope to take a look at bubblejail to have an easier way to do sandboxing. You can see the arch wiki bubblewrap examples to notice how bubblewrap doesn’t help with apparmor profiles though. According to the arch wiki for bubblejail or the GH page for bubblejail profiles are used and can easily be created, however I have no idea of the interaction with apparmor, and if as with firejail such profiles include apparmor stuff, but intuitively I guess it doesn’t.
Going back to apparmor, which is MAC enforcement, if no profiles available on your distro for librewolf neither firefox, then looking at other distros is OK, and also one can create profiles as well as one can also modify existent or available ones. See for example the arch wiki for apparmor.
firejail
I would recommend not touching Firejail unless you are 100% sure you know what you are doing, as it can (and probably will) worsen security.
I 100% recommend bubblejail. A sandboxing utility based on bubnlewrap. The same that Flatpaks use I believe. It has a CLI and a GUI. And its super portable.
Flatpak’s use of bubblewrap (it comes from flatpak but then it became its own project) is not a good example, see:
https://madaidans-insecurities.github.io/linux.html#flatpak
But in general this is true. I talked out of memory, but firejail given its suid way is considered insecure (possible privilege escalation), that’s right
You are correct flatpak uses bubblewrap
Removed by mod
ligma balls
Removed by mod
