this post was submitted on 22 Jan 2025
35 points (92.7% liked)

Linux

49276 readers
1643 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
35
Best ways to Sandbox a sketchy Game on Linux? (sh.itjust.works)
submitted 4 days ago* (last edited 1 day ago) by [email protected] to c/[email protected]
16 comments fedilink hide all child comments
 

What are the best ways to run a game on sandboxed mode with only game HDD shared to it. There should not be network access for the game and there should be GPU (intel integrated) pass-through.

I have tried Gnome boxes, but GPU pass through is not working and checked distrobox, but that too shares HOME folder.

Update: I have installed Bubblejail and sandboxed Alacritty. Shared a Directory in with it on Home and disabled network. Since my game is launched using a shell script, I use this setup for it.

top 16 comments
sorted by: hot top controversial new old
[–] that_leaflet 27 points 4 days ago (1 children)

You can do this using Lutris.

  1. Install it from Flathub
  2. Open Lutris and have it install the tools it needs (wine, dxvk, etc)
  3. Close Lutris
  4. Use Flatseal to limit its permissions; remove network, filesystem access, etc
  5. Open Lutris and run the game

Note that this isn't a perfect sandbox. For example, the game can still send a link to your browser to open. Theoretically it could do something malicious with that. Though you could probably work around that issue by changing your default browser to a flatpak version and disable network access there. There might be other small sandbox breaks, but nothing I can think of.

[–] [email protected] 3 points 4 days ago (1 children)

Can the same be say with bottle?

[–] that_leaflet 6 points 4 days ago

Yes

[–] [email protected] 8 points 3 days ago

QEMU virtual machine with GPU passthrough.

[–] kutsyk_alexander 9 points 4 days ago (1 children)

You can try Firejail

[–] [email protected] 11 points 4 days ago* (last edited 4 days ago) (2 children)

Fitejail is a large SETUID binary which weakens security and can aid in privilege escalation. Use Bubblewrap (preinstalled on most Linux systems cus of Flatpak) which runs unpriveleged. Bubblejail is a program that makes it easier to make sandboxes profiles for apps.

[–] [email protected] 2 points 1 day ago

Thank you for the recommendation. I plan to use Bubblejail.

[–] [email protected] 4 points 4 days ago

Oof, I didn't know that about firejail. I'd heard of it, but I'd never used it. Like, c'mon folks! If you need privilege escalation, either require launching as root (if appropriate), or delegate the responsibility to a small, well-audited tool designed explicitly for the purpose and spawn a new privileged pid. Don't use SUID. You will fuck it up. If you reach the point where setuid is your only option, then you've hopefully learned enough to rearchitect to not need it, or to give up, or use it if you're, say, someone who maintains a libc or something.

EDIT: this is overly dramatic, but also it's not. I personally feel like using SUID is kinda like rolling your own crypto in terms of required competence.

[–] [email protected] 3 points 3 days ago

I've done this before by packaging it in a snap. No filesystem access except its own snap directory, no network access because I didn't request it in the snapcraft.yaml, but yes GPU and audio access through the desktop plug.

[–] [email protected] 4 points 4 days ago (2 children)

There are systemd nspawn Containers, you could install debian, or whatever you fancy inside, they provode simmillar isolation to docker containers and you can even integrate them with gui.

Containerized apps will then only see the container folder

https://michael.franzl.name/blog/posts/2023-12-02-run-graphical-wayland-applications-in-systemd-nspawn

[–] [email protected] 10 points 4 days ago (1 children)

Keep in mind that non-hardenized containers only protect you from bugs, they don't protect you from sophisticated malware. If you suspect the software you are trying to run might be a virus, don't run it, or run it in a virtual machine.

I would recommend using containers only if you absolutely understand how to make them secure AND you have no reason to suspect the software you are running might contain nefarious code. In any other case use a virtual machine.

[–] [email protected] 1 points 4 days ago (1 children)

true enough, video acceleration is a bit harder / more expensive with an extra gpu, thats why i shyed away from suggesting vms

[–] [email protected] 1 points 4 days ago* (last edited 4 days ago)

Yeah, I realize that and that's a nuisance for a videogame... If the game is small enough, OP might be able to give it a virtual GPU with VirtualBox, I did it in the past to play with friends on a single computer. I don't know if the usual KVM-based VMs support it as well.

[–] [email protected] 2 points 4 days ago

im not on arch but the explanation is still valuable: https://wiki.archlinux.org/title/Systemd-nspawn

[–] [email protected] 3 points 4 days ago

I got some answers to a similar question here https://lemm.ee/post/45993313

[–] [email protected] 1 points 4 days ago

Don't.