# Sandboxing all programs by default
**URL:** https://discourse.nixos.org/t/sandboxing-all-programs-by-default/7792
**Category:** Help
**Created:** [June 21, 2020, 9:18pm UTC](https://discourse.nixos.org/t/sandboxing-all-programs-by-default/7792 "2020-06-21T21:18:35Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@energizer](https://discourse.nixos.org/u/energizer)
#### Post date: [June 21, 2020, 9:18pm UTC](https://discourse.nixos.org/t/sandboxing-all-programs-by-default/7792/1 "2020-06-21T21:18:35Z")
Linux desktop applications are relatively unconstrained by default: they can access the user’s home directory, execute any program, and interact with arbitrary network locations. This free access is convenient, but also raises security concerns around misconfigured or misbehaving programs.
There are several existing tools to help with application security.
- [Fedora Silverblue](https://docs.fedoraproject.org/en-US/fedora-silverblue/) is an immutable Linux distribution that distributes packages using the Flatpak format, which runs applications in a [Flatpak application sandbox](https://docs.flatpak.org/en/latest/sandbox-permissions.html) by default.
- Since 2005, Linux has had a “secure computing” feature, [`seccomp`](https://man7.org/linux/man-pages/man2/seccomp.2.html), which allows restricting applications’ access to various resources. [Firejail](https://firejail.wordpress.com/documentation-2/basic-usage/) is a program that takes advantage of `seccomp` to sandbox applications, limiting their access to files and interfaces that the user allows. Firejail also provides a [large set of configurations](https://github.com/netblue30/firejail/tree/master/etc/profile-a-l) for popular applications, allowing these applications the resources they need and denying the resources they don’t need.
- Another tool is [Bubblewrap](https://github.com/containers/bubblewrap), which says:
There has been [some](https://github.com/NixOS/nix/pull/2909#issue-284205153) prior [discussion](https://github.com/NixOS/nixpkgs/issues/25775) of application sandboxing in NixOS, so it sounds like people are interested. I’m interested in continuing the conversation, focusing on how we can move toward a more comprehensive solution that enables convenient but safe application usage _by default_.
For example, would it be realistic to create a version of nixpkgs that wraps _all_ application binaries in a firejail/flatpack/bubblewrap sandbox execution environment? If not, what would be a better path forward?
---
### Author:  [@aanderse](https://discourse.nixos.org/u/aanderse)
#### Post date: [June 21, 2020, 10:50pm UTC](https://discourse.nixos.org/t/sandboxing-all-programs-by-default/7792/2 "2020-06-21T22:50:42Z")
Maybe @peterhoeg has some thoughts on `firejail`…
---
### Author:  [@8573](https://discourse.nixos.org/u/8573)
#### Post date: [June 22, 2020, 2:35am UTC](https://discourse.nixos.org/t/sandboxing-all-programs-by-default/7792/3 "2020-06-22T02:35:59Z")
Another technology that may be relevant is [AppArmor](https://apparmor.net). Currently this is used to ‘armor’ `ping` and a small number of services. Apparently it is used somewhat more broadly in Ubuntu; I hadn’t thought until now to look up [their AppArmor profiles](https://gitlab.com/apparmor/apparmor-profiles/-/tree/master/ubuntu/20.04), but, doing so, I see that they have profiles for some important targets that NixOS doesn’t seem to be AppArmor-ing, such as Web browsers and some widely-used services.
---
### Author:  [@ajs124](https://discourse.nixos.org/u/ajs124)
#### Post date: [June 22, 2020, 1:48pm UTC](https://discourse.nixos.org/t/sandboxing-all-programs-by-default/7792/4 "2020-06-22T13:48:35Z")
I have something based on AppArmor similar to [systemd confinement](https://github.com/NixOS/nixpkgs/blob/9c42eb70cfdb2e59c001a4cdae0b2c9875dd44c3/nixos/modules/security/systemd-confinement.nix). It only works for systemd services though and is sadly not in a state fit for nixpkgs. It’s been on my todo list to clean it up and post it somewhere, but I’m not sure when I’ll get around to it.
There are even plans (or rather ideas) to expand it for other apps, maybe make it system wide.
In general, for all these approaches, `nix` can give you the closure of any storepath through `exportReferencesGraph`/`closureInfo`. So for path based stuff, you can generate profiles from that with an additional whitelist for paths etc. the application needs.
---
### Author:  [@aszlig](https://discourse.nixos.org/u/aszlig)
#### Post date: [June 23, 2020, 5:47am UTC](https://discourse.nixos.org/t/sandboxing-all-programs-by-default/7792/5 "2020-06-23T05:47:43Z")
> [@ajs124](#):
>
> I have something based on AppArmor similar to [systemd confinement](https://github.com/NixOS/nixpkgs/blob/9c42eb70cfdb2e59c001a4cdae0b2c9875dd44c3/nixos/modules/security/systemd-confinement.nix). It only works for systemd services though and is sadly not in a state fit for nixpkgs. It’s been on my todo list to clean it up and post it somewhere, but I’m not sure when I’ll get around to it.
I’ve also written something [like this](https://github.com/openlab-aux/vuizvui/tree/ba416c3aa04407df7dc1c2b06ef4a02b1d18654a/pkgs/build-support/build-sandbox) a while ago for packaging proprietary games. What it basically does is setting up mount/user/pid/uts/ipc namespaces and bind-mount all the runtime dependencies at [build time](https://github.com/openlab-aux/vuizvui/blob/ba416c3aa04407df7dc1c2b06ef4a02b1d18654a/pkgs/build-support/build-sandbox/default.nix#L40-L56) (seeing that comment by @Profpatsch reminds me that I should probably replace it by [`closureInfo`](https://github.com/NixOS/nixpkgs/blob/fdfe99bfe293344ab0e7604483cea1fee83775f5/pkgs/build-support/closure-info.nix)), other dependencies from [`PATH-like variables`](https://github.com/openlab-aux/vuizvui/blob/ba416c3aa04407df7dc1c2b06ef4a02b1d18654a/pkgs/build-support/build-sandbox/src/setup.c#L642-L666) and [extra paths](https://github.com/openlab-aux/vuizvui/blob/ba416c3aa04407df7dc1c2b06ef4a02b1d18654a/pkgs/build-support/build-sandbox/default.nix#L75-L76).
The implementation at the moment isn’t as locked down as I’d want it for a more generic implementation (for example it allows access to the X server), but that’s because - as mentioned - it was built [for games](https://github.com/openlab-aux/vuizvui/blob/ba416c3aa04407df7dc1c2b06ef4a02b1d18654a/pkgs/games/build-support/build-game.nix) (examples: [1](https://github.com/openlab-aux/vuizvui/blob/ba416c3aa04407df7dc1c2b06ef4a02b1d18654a/pkgs/games/gog/xeen.nix#L116-L119) [2](https://github.com/openlab-aux/vuizvui/blob/ba416c3aa04407df7dc1c2b06ef4a02b1d18654a/pkgs/games/build-support/build-unity.nix#L33-L39)) after all.
Is your implementation public somewhere?
---
### Author:  [@8573](https://discourse.nixos.org/u/8573)
#### Post date: [August 5, 2020, 4:54pm UTC](https://discourse.nixos.org/t/sandboxing-all-programs-by-default/7792/6 "2020-08-05T16:54:33Z")
Some recent work on AppArmor in NixOS is [https://github.com/NixOS/nixpkgs/pull/93457](https://github.com/NixOS/nixpkgs/pull/93457), though AFAIK it doesn’t change how narrowly AppArmor is used.
---
### Author:  [@nixinator](https://discourse.nixos.org/u/nixinator)
#### Post date: [October 31, 2020, 10:09pm UTC](https://discourse.nixos.org/t/sandboxing-all-programs-by-default/7792/7 "2020-10-31T22:09:26Z")
Keep an eye on [https://spectrum-os.org/](https://spectrum-os.org/) , which is currently in development, no release as of yet, but this might be exactly what your looking for 🙂
---
### Author:  [@8573](https://discourse.nixos.org/u/8573)
#### Post date: [November 1, 2020, 12:32am UTC](https://discourse.nixos.org/t/sandboxing-all-programs-by-default/7792/8 "2020-11-01T00:32:57Z")
> [@nixinator](#):
>
> Keep an eye on [https://spectrum-os.org/](https://spectrum-os.org/)
Qubes-esque + usability + Nix (+ EU funding) sounds interesting, even if subscribing to their announcements was a bit annoying with the email account I wanted to use (details are in a [details] block because they’re… rather off-topic).
> **(In case anyone else wants to subscribe to Spectrum OS's announcements with Gmail on Android, here's what I did.)**
>
> Try to subscribe to the announcements mailing list, which requires emailing a message to a specified address; get told that my blank message was rejected because it was HTML rather than plain text (Gmail for Android can’t send non-HTML messages). Open the Gmail website (in Chrome). I’m on Android, so this defaults to a unhelpfully minimal mobile version of the website; trying Chrome’s “Desktop site” option doesn’t help. Open the website’s hamburger menu, which opens a side pane; scroll to the bottom; select the last option in “Mobile | Older version | Desktop”; on the next screen, with Chrome’s “Desktop site” option enabled, select “Take me to latest Gmail”. Note this results in being returned to the same screen; remember that I can get past this screen by clearing cookies. Clear cookies for `mail.google.com`. Sign back in. Finally I get the real desktop version of the website. Now go through some more cycles of this and remember to push the right buttons at the right times to get the account I want to use. Accept the fiddliness of the full desktop version’s UI on mobile and finally send the required message in plain text and get subscribed.
---
### Author:  [@Atemu](https://discourse.nixos.org/u/Atemu)
#### Post date: [December 9, 2020, 4:33pm UTC](https://discourse.nixos.org/t/sandboxing-all-programs-by-default/7792/9 "2020-12-09T16:33:44Z")
I was able to subscribe by simply entering my email [here](https://spectrum-os.org/lists/postorius/lists/announce.spectrum-os.org/) and sending an empty reply (same subject) to the email it sent me.
---
### Author:  [@zyansheep](https://discourse.nixos.org/u/zyansheep)
#### Post date: [March 23, 2025, 11:20pm UTC](https://discourse.nixos.org/t/sandboxing-all-programs-by-default/7792/10 "2025-03-23T23:20:24Z")
Apologies for necroposting, but this might now be possible to do manually on a per-program basis: [GitHub - nixpak/nixpak: Runtime sandboxing for Nix](https://github.com/nixpak/nixpak)
Perhaps it might be possible to auto-generate this shim for all executables on the system? The overhead might be a bit too much there but who knows.
---
### Author:  [@Cal-Nine](https://discourse.nixos.org/u/Cal-Nine)
#### Post date: [February 16, 2026, 5:39am UTC](https://discourse.nixos.org/t/sandboxing-all-programs-by-default/7792/11 "2026-02-16T05:39:29Z")
[Apparmor.d](https://discourse.nixos.org/t/apparmor-on-nixos-roadmap/57217/) for confining basics, anything given network access by apparmor sandboxed with NixPak or similar?