Firejail: Add support for ipvlan interfaces

[ValdikSS]

Firejail adds new macvlan interface when --net option is specified. While macvlan is a best choice for Ethernet interfaces, it doesn't work with 802.11 Wi-Fi.
Right now there's no easy way to use Wi-Fi with Firejail. Documentation describes routed setup, which @netblue30 recommends to use in #1600.
Linux kernel contains another interface driver which is very similar to macvlan and works with Wi-Fi: ipvlan. Contrary to macvlan, it shares the same MAC address as the master interface, which allows it to be used with 802.11.

@netblue30, is it possible to auto-detect interface type and use either macvlan for Ethernet and ipvlan for 802.11?

Here's how you can create this interface and use it in Firejail:

sudo ip link add link wlp3s0 firewifi type ipvlan mode l2; sudo ip link set firewifi up; sudo ip addr add 192.168.0.199/24 dev firewifi
firejail --interface=firewifi --noprofile

[netblue30]

Let me give it a try, thanks for the idea!

[netblue30]

All in mainline, you can try it out, in your case:
$ firejail --net=wlp3s0 firefox

[chiraag-nataraj]

Hmm, I tried something as simple as firejail --noprofile --net=wlp60s0 and wasn't able to connect with the outside world. Trying to ping a host would resolve but time out with destination unreachable. Am I doing something wrong? Is there some extra preparation that needs to happen for this to work properly?

[ValdikSS]

@netblue30 it indeed doesn't work for some reason. It doesn't add default route, but adding it manually does not fix the issue. Are you sure you set up ipvlan of type l2?

[ValdikSS]

@netblue30 I can't see where IPVLAN_MODE_L2 is defined. It looks like there are no changes to automake/autoconf, and nobody defines it.

[netblue30]

Something didn't got merged! Let me take a look, thanks!

[netblue30]

Should be all fixed now: https://github.com/netblue30/firejail/commit/b78cc5869307ddb93a7b1795af992356a54d1d21