There are so many options, from so many different security perspectives, that analysis paralysis is a real issue.
For user-space, there is usually bubblewrap vs. firejail. I have not personally used bubblewrap, so I cannot comment on that, but firejail is great at what it does.
The last comment was about restricting clipboard access to either X11 or Wayland which is possible with firejail quite easily, so if you want that, you can have that.
You can do a LOT more with firejail though.
In case anyone else is curious, I found the following comparison in bubblewrap's repo.
- https://github.com/containers/bubblewrap#related-project-com...
I'm gonna try both and see which one I like. Thanks for this info! You're sure living up to your user name there. (:
> You're sure living up to your user name there. (:
You are too kind, thank you!
This is my ~/.config/firejail/Discord.profile[1]:
include disable-common.inc
include disable-devel.inc
include disable-interpreters.inc
include disable-shell.inc
noblacklist /sys/fs
noblacklist /sys/module
keep-config-pulse
keep-dev-shm
name discord
apparmor
caps.drop all
caps.keep sys_admin,sys_chroot
netfilter
nodvd
#nogroups
#noinput
nonewprivs
noroot
notv
#nou2f
#novideo
protocol unix,inet,inet6
#shell none
disable-mnt
private-cache
#private-tmp
noexec /tmp
dbus-user filter
dbus-user.talk org.freedesktop.Notifications
private-bin Discord,cut,echo,egrep,electron,electron[0-9],electron[0-9][0-9],grep,head,sed,sh,tr,xdg-mime,xdg-open,zsh,gzip,wget,curl,notify-send
private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.preload,localtime,login.defs,machine-id,password,pki,pulse,resolv.conf,ssl
noblacklist /usr/lib/discord/
whitelist ${HOME}/.config/discord
read-write ${HOME}/.config/discord
whitelist ${DOWNLOADS}
whitelist ${HOME}/.config/pulse/*
include whitelist-common.inc
include whitelist-var-common.inc
include whitelist-run-common.inc
include whitelist-runuser-common.inc
Some has this, too:
disable-mnt
private-dev
private-cache
env http_proxy=socks5://127.0.0.1:9050
env https_proxy=socks5://127.0.0.1:9050
You should check out the default profiles for many programs / apps under directory "/etc/firejail".
[1] You run it via "firejail Discord" or "firejail ./Discord" if you name it "Discord.profile".
https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...