"Don't use [Firejail] on enterprise servers, or any other multiuser system." Still true?

[ginto37]

"Firejail was built for single-user desktops."

Both direct quotes from @netblue30 in 2022 - #3046 .

Is this still the case for multiuser systems? If not, why not?

[netblue30]

Yes, it is a big problem on multiuser systems. Actually two of them:

• SUID: a regular user might be tempted to try to exploit the program and get root access.
• Networking: a regular use can bypass the system firewall, redirect his DNS traffic to a different server, use random MAC and IP addresses on the local net, although these actions should be detected by network monitoring tools. Such an event will drive the network admin crazy, since pointing out the physical computer generating the traffic is very difficult. If you also bring in DNS over HTTPS, the game is over - they will immediately assume somebody is siphoning data to an outside server.

I would stay away from enterprise networks, sandboxing technologies are not exactly compatible with the security tools they have.

[ginto37]

The package description on Debian doesn't mention this:

sandbox to restrict the application environment
 Firejail is a SUID security sandbox program that reduces the risk of
 security breaches by restricting the running environment of untrusted
 applications using Linux namespaces and seccomp-bpf.  It allows a
 process and all its descendants to have their own private view of the
 globally shared kernel resources, such as the network stack, process
 table, mount table.

Personally I think it should. Who's responsible for updating those texts, is it the package maintainers?