Firejail: Chromium sys_chroot and sys_admin permissions

[Zypherspace]

Chrome and Chromium firejail profiles enable sys_chroot and sys_admin kernel privileges. Is it possible to disable these by disabling Chrome's internal sandbox, or any other method?

[Vincent43]

Chrome sandbox is considered one of the best in industry. Disabling it will negatively impact security. Those privileges are available only for parent process, not for those exposed to web browsing.

[curiosity-seeker]

@Zypherspace : Distros with newer kernels don't require that anymore.

My profile (on Fedora 28) contains:

seccomp.keep access,arch_prctl,bind,brk,capget,capset,chdir,chmod,chroot,clock_getres,clone,close,connect,creat,dup,dup2,epoll_create,epoll_ctl,epoll_wait,epoll_pwait,eventfd2,execve,faccessat,fadvise64,fchmod,fcntl,fdatasync,fstat,fstatfs,ftruncate,futex,getdents,getdents64,getegid,geteuid,getgid,getpeername,getpgrp,getpid,getppid,getpriority,getrandom,getresgid,getresuid,getrlimit,getsockname,getsockopt,gettid,getuid,inotify_add_watch,inotify_init,inotify_init1,inotify_rm_watch,ioctl,kill,listen,lseek,lstat,madvise,memfd_create,mkdir,mmap,mprotect,munmap,nanosleep,newfstatat,open,openat,personality,pipe,pipe2,poll,ppoll,prctl,pread64,pwrite64,read,readlink,readlinkat,recvfrom,recvmsg,rename,rmdir,rt_sigaction,rt_sigprocmask,rt_sigreturn,sched_getaffinity,sched_getparam,sched_getscheduler,sched_setscheduler,sched_yield,seccomp,select,sendmsg,sendto,setpriority,setrlimit,set_robust_list,setsockopt,set_tid_address,shutdown,socket,socketpair,stat,statfs,symlink,sysinfo,umask,uname,unlink,unshare,wait4,waitid,write,writev,setresuid,setresgid,exit_group,tgkill,exit,utimensat,personality,setxattr,mremap,clock_gettime,fchown,getcwd,prlimit64,fallocate,msync

caps.drop all

noroot
nogroups
nonewprivs

ipc-namespace
machine-id

You can try if this works for you. It's possible that the list of necessary syscalls for your distro differs a bit. This guide helps to find out.

[Vincent43]

[Zypherspace]