Jailing GUI Applications

This is a short tutorial on how to run GUI applications jailed. This is done primarily for Firefox but the same principle can be applied for any other application.

Creating a basic jail depends on your favorite jail abstraction tool. But to hide all the abstractions, we're going to do it all manually, and based on ZFS, so feel free to adapt the tasks for whatever jail management tool you're using.

To begin with, we'll dedicate zroot/jails as the base dataset for all jail deployments, and create a basejail in zroot/jails/basejail. The basejail method allows us to simply zfs clone it into target jail dataset, which is the most efficient way to share the base jail among other jails. Updating them all then requires updating the basejail and re-creating jail roots. Here's how.

# zfs create -o compress=lz4 -o atime=off zroot/jails
# zfs create zroot/jails/basejail
# bsdinstall jail /zroot/jails/basejail

Here we used the bsdinstall method for convenience. Otherwise downloading and unpacking base.txz and configuring it should suffice. At this point we'd configure the basejail for pkg, like the location of your Poudriere repo if you have it. No other configuration is required for the base as the jails will basically run a single process.

So we snapshot it and create our Firefox jail filesystem:

# zfs snapshot zroot/jails/basejail@latest
# zfs create zroot/jails/firefox
# zfs clone zroot/jails/basejail@latest zroot/jails/firefox/root
# zfs create zroot/jails/firefox/var
# zfs create zroot/jails/firefox/tmp
# zfs create zroot/jails/firefox/home
# rsync -a /zroot/jails/firefox/root/var/ /zroot/jails/firefox/var/
# zfs set mountpoint=/zroot/jails/firefox/root/var zroot/jails/firefox/var
# zfs set mountpoint=/zroot/jails/firefox/root/tmp zroot/jails/firefox/tmp
# zfs set mountpoint=/zroot/jails/firefox/root/usr/home zroot/jails/firefox/home

For extra security we want our jail to run with minimum require privilege, so we set some properties on these datasets, which should make obvious why we separated them like this: