Implement Application Sandboxing

Posted January 19Jan 19

You are reading Part 31 of the 57-part series: Harden and Secure Linux Servers. [Level 4]

This series covers progressive security measures, from fundamental hardening techniques to enterprise-grade defense strategies. Each article delves into a specific security practice, explaining its importance and providing step-by-step guidance for implementation.

To explore more security best practices, visit the main guide for a full breakdown of all levels and recommendations.

Application sandboxing isolates applications from the rest of the system, preventing them from accessing sensitive files, making unauthorized system modifications, or exploiting vulnerabilities. This enhances security by:

✅ Preventing applications from accessing system-critical files.
✅ Reducing the risk of privilege escalation if an application is compromised.
✅ Limiting the damage caused by malware or rogue applications.

By sandboxing applications, you minimize the risk that a vulnerability in one application will affect the entire system.

How to Implement Application Sandboxing in Linux

1. Use Firejail for Process Sandboxing

Firejail is a lightweight sandboxing tool that restricts applications using Linux namespaces and seccomp-bpf filters.

Install Firejail (Debian/Ubuntu-based systems)

sudo apt install firejail -y

For CentOS/RHEL, install from source:

sudo yum install epel-release -y
sudo yum install firejail -y

Run an Application in a Firejail Sandbox

To launch a program in a restricted environment:

firejail firefox

(This isolates Firefox, preventing it from accessing system files outside its sandbox.)

List Available Firejail Profiles (Pre-configured Security Rules)

ls /etc/firejail/

(Pre-configured profiles exist for common applications like browsers, text editors, and media players.)

Create a Custom Firejail Profile for an Application

To define strict file access rules for a sandboxed application:

Copy the default profile:

sudo cp /etc/firejail/default.profile /etc/firejail/custom_app.profile

Edit it:

sudo nano /etc/firejail/custom_app.profile

Restrict access to specific directories:

noblacklist /home/user/Documents
whitelist /home/user/sandbox

Run the application with the custom profile:

firejail --profile=/etc/firejail/custom_app.profile myapp

2. Use AppArmor for Mandatory Access Control (Ubuntu/Debian)

AppArmor restricts what files, capabilities, and network access an application can use.

Check if AppArmor is Enabled

sudo apparmor_status

Install AppArmor (If Not Installed)

sudo apt install apparmor-utils -y

Enable AppArmor for an Application

Create a profile for an application (e.g., nginx):
```
sudo nano /etc/apparmor.d/usr.sbin.nginx
```

Define restricted access rules:

/usr/sbin/nginx {
    include <abstractions/base>
    /var/www/html/** r,
    /etc/nginx/nginx.conf r,
    /var/log/nginx/** rw,
}

Load and enforce the profile:

sudo apparmor_parser -a /etc/apparmor.d/usr.sbin.nginx

3. Use Flatpak or Snap for Secure Application Sandboxing

Both Flatpak and Snap run applications in isolated containers with limited system access.

Install Flatpak (Recommended for Desktop Apps)

sudo apt install flatpak -y

Run applications securely:
```
flatpak run app_name
```

Install Snap for Secure Application Deployment

sudo apt install snapd -y

Run applications securely:
```
snap install app_name
```

Best Practices for Application Sandboxing

✅ Sandbox high-risk applications like browsers, media players, and software with internet access.
✅ Regularly update sandboxing policies to stay ahead of security threats.
✅ Combine sandboxing with AppArmor, SELinux, or Firejail for maximum security.
✅ Monitor application behavior to ensure sandboxes are working (journalctl -xe | grep apparmor).

By sandboxing applications, you restrict their access to system resources, reducing the risk of malware, exploits, and unauthorized modifications, keeping your Linux environment secure.

Quote

Sign In