weixin_39886024
weixin_39886024
2021-01-08 11:10

Add support for ipvlan interfaces

Firejail adds new macvlan interface when --net option is specified. While macvlan is a best choice for Ethernet interfaces, it doesn't work with 802.11 Wi-Fi. Right now there's no easy way to use Wi-Fi with Firejail. Documentation describes routed setup, which recommends to use in #1600. Linux kernel contains another interface driver which is very similar to macvlan and works with Wi-Fi: ipvlan. Contrary to macvlan, it shares the same MAC address as the master interface, which allows it to be used with 802.11.

, is it possible to auto-detect interface type and use either macvlan for Ethernet and ipvlan for 802.11?

Here's how you can create this interface and use it in Firejail:


sudo ip link add link wlp3s0 firewifi type ipvlan mode l2; sudo ip link set firewifi up; sudo ip addr add 192.168.0.199/24 dev firewifi
firejail --interface=firewifi --noprofile

该提问来源于开源项目:netblue30/firejail

  • 点赞
  • 写回答
  • 关注问题
  • 收藏
  • 复制链接分享
  • 邀请回答

7条回答

  • weixin_39613692 weixin_39613692 4月前

    Let me give it a try, thanks for the idea!

    点赞 评论 复制链接分享
  • weixin_39613692 weixin_39613692 4月前

    All in mainline, you can try it out, in your case:

    ``
    $ firejail --net=wlp3s0 firefox
    

    ``

    点赞 评论 复制链接分享
  • weixin_39658900 weixin_39658900 4月前

    Hmm, I tried something as simple as firejail --noprofile --net=wlp60s0 and wasn't able to connect with the outside world. Trying to ping a host would resolve but time out with destination unreachable. Am I doing something wrong? Is there some extra preparation that needs to happen for this to work properly?

    点赞 评论 复制链接分享
  • weixin_39886024 weixin_39886024 4月前

    it indeed doesn't work for some reason. It doesn't add default route, but adding it manually does not fix the issue. Are you sure you set up ipvlan of type l2?

    点赞 评论 复制链接分享
  • weixin_39886024 weixin_39886024 4月前

    I can't see where IPVLAN_MODE_L2 is defined. It looks like there are no changes to automake/autoconf, and nobody defines it.

    点赞 评论 复制链接分享
  • weixin_39613692 weixin_39613692 4月前

    Something didn't got merged! Let me take a look, thanks!

    点赞 评论 复制链接分享
  • weixin_39613692 weixin_39613692 4月前

    Should be all fixed now: https://github.com/netblue30/firejail/commit/b78cc5869307ddb93a7b1795af992356a54d1d21

    点赞 评论 复制链接分享

相关推荐