SANDBOX(8)

welcome to section 8, User Commands, bestie — this is the sandbox(8) page, and yes it's about locking an app in a little SELinux glass case so it can't touch your stuff. sit down, hydrate, we're doing this. 🍓

---

🌸 NAME 🌸

sandbox — run cmd under an SELinux sandbox. that's the whole thing. short, sweet, iconic. 💅

---

🦋 SYNOPSIS 🦋

sandbox [-C] [-s] [ -d DPI ] [-l level ] [[-M | -X]  -H homedir -T
tempdir ] [ -R runuserdir ] [-I includefile ] [ -W windowmanager ] [ -w
windowsize ] [[-i file ]...] [ -t type ] cmd

sandbox [-C] [-s] [ -d DPI ] [-l level ] [[-M | -X]  -H homedir -T
tempdir ] [ -R runuserdir ] [-I includefile ] [ -W windowmanager ] [ -w
windowsize ] [[-i file ]...] [ -t type ] -S

two whole forms, the second one is just the first one but ending in -S. slay. ✨

---

💜 DESCRIPTION 💜

so what's actually happening? you run the cmd application inside a tightly confined SELinux domain. read that again. tightly confined. 💀

the default sandbox domain gives applications exactly one (1) privilege: read and write stdin, stdout, and any other file descriptors that get handed to it. it is not allowed to open any other files. not one. none. zero. that's the whole point, and honestly? main character energy. 👑

the -M option will mount an alternate homedir and tmpdir to be used by the sandbox. cute little fake house for your app. 🏠

---

if you have the policycoreutils-sandbox package installed, you unlock the -X option and the -M option. sandbox -X lets you run X applications inside a sandbox. these applications will start up their own X Server and create a temporary home directory and /tmp. it's giving tiny apartment.

the default SELinux policy does not allow any capabilities or network access. it also prevents all access to the user's other processes and files. like, all of them. blocked. no cap. 🙈

files specified on the command that are in the home directory or /tmp will be copied into the sandbox directories. so bring your snacks, they get their own copies. 🎀

---

if directories are specified with -H or -T the directory will have its context modified with chcon(1) unless a level is specified with -l. and if the MLS/MCS security level is specified, the user is responsible to set the correct labels. that's on you, bestie, not on the tool. 🫶

---

💅 the options (yes, all of them) 💅

• -h, --help — display usage message. the classic. the icon.
• -H, --homedir — Use alternate homedir to mount over your home directory. Defaults to temporary. Requires -X or -M.
• -i, --include — Copy this file into the appropriate temporary sandbox directory. Command can be repeated.
• -I, --includefile — Copy all files listed in inputfile into the appropriate temporary sandbox directories.
• -l, --level — Specify the MLS/MCS Security Level to run the sandbox with. Defaults to random. 🎲
• -M, --mount — Create a Sandbox with temporary files for $HOME and /tmp.
• -s, --shred — Shred temporary files created in $HOME and /tmp, before deleting. dramatic and correct. 🔥
• -t, --type — Use alternate sandbox type, defaults to sandbox_t or sandbox_x_t for -X.
  • Examples:
  • sandbox_t - No X, No Network Access, No Open, read/write on passed in file descriptors.
  • sandbox_min_t - No Network Access
  • sandbox_x_t - Ports for X applications to run locally
  • sandbox_web_t - Ports required for web browsing
  • sandbox_net_t - Network ports (for server software)
  • sandbox_net_client_t - All network ports
• -T, --tmpdir — Use alternate temporary directory to mount on /tmp. Defaults to tmpfs. Requires -X or -M.
• -R, --runuserdir — Use alternate temporary directory to mount on XDG_RUNTIME_DIR (/run/user/$UID).
• -S, --session — Run a full desktop session, Requires level, and home and tmpdir.
• -w, --windowsize — Specifies the windowsize when creating an X based Sandbox. The default windowsize is 1000x700.
• -W, --windowmanager — Select alternative window manager to run within sandbox -X. Default to /usr/bin/matchbox-window-manager.
• -X — Create an X based Sandbox for gui apps, temporary files for $HOME and /tmp, secondary Xserver, defaults to sandbox_x_t
• -d, --dpi — Set the DPI value for the sandbox X Server. Defaults to the current X Sever DPI.
• -C, --capabilities — Use capabilities within the sandbox. By default applications executed within the sandbox will not be allowed to use capabilities (setuid apps), with the -C flag, you can use programs requiring capabilities.

real talk: that -t list is doing a lot of heavy lifting. memorize it or don't, but it's all here, fr fr. 💖

---

🔥 SEE ALSO 🔥

runcon(1), seunshare(8), selinux(8)

go read those next, bestie, they're the friends of this page. 🦋

---

🌈 EXAMPLE 🌈

Run a graphical application inside the sandbox

# sandbox -X evince

Run a graphical application that requires the use of network

# sandbox ‑X ‑t sandbox_web_t firefox

Preserve data from one session to the next

# mkdir -p ~/sandbox/home ~/sandbox/tmp
# sandbox -H ~/sandbox/home -T ~/sandbox/tmp -X libreoffice --writer

literally copy-paste these, that's what they're for. 🎀

---

💖 AUTHOR 💖

This manual page was written by Dan Walsh <dwalsh@redhat.com> and Thomas Liu <tliu@fedoraproject.org>

---

okay that's the whole page, you made it, I'm so proud. 🫶 this sandbox page (source sandbox, dated May 2010, sitting pretty in section SANDBOX(8)) is officially yours now. go confine something. periodt. 💅✨