In Ubuntu 19.04, you can install Chromium using snap like this:
sudo snap install chromium
However, when installing Chromium via snap, you cannot sandbox it with firejail like this:
firejail chromium-browser
The command above runs the non-snap version of chromium in a sandbox where chromium only has access to the Downloads folder (and not your entire home folder).
However, when Chromium is install as a SNAP, firejail cannot achieve these file system restrictions. When you use Chromium installed via sudo apt install chromium-browser
, firejail works, but it doesn't work with snap-installed chromium.
I understand that future versions of Ubuntu will only be offering the snap package of Chromium, so that's why I'm trying to address this issue right now in Ubuntu 19.04. See this as well.
I've requested an alternative snap installation method, that only gives Chromium access to the Downloads
folder here.
Until then, how can I sandbox Chromium (installed via SNAP), in a manner like firejail sandboxes Chromium (installed via apt)?
According to Firejail's man page which you can access by the command
man firejail
, they do not support snap packages.Using Firejail would be like using a sandbox inside a sandbox.
Flatpak and Snap have their own sandboxing strategies. One and the other with their flaws. A lot has been written about (note that some of this issues might be already solved):