Post #3781614

2026-07-13 09:01 UTC

Firejail is definitely something I’ll be looking into on the sandboxing front as it may be the better solution from the sounds of it. How does a sandbox compare to running in a VM? Technically speaking, is the VM safer? Though I appreciate the difference in this scenario may be very small.

Replies (2)

@helix@feddit.org 2026-07-13 18:33

The VM is definitely safer by an order of magnitude, because you can use hardware CPU features to guard address areas and have separate Kernels for your games and other OS. However, look at this recent security hole: lemmy.zip/post/67733533 Security is never absolute, it’s always relative. It’s also never done, as with time any system can become hacked. Security is both a process and a consideration. Your threat model is that you download malware which is either written for Windows or has some nasty Linux exploits baked in (as Steam Decks are popular now aswell). I doubt if most people run games without sandboxes that they try to get out of a user namespace with a privilege escalation. Sandboxing in Linux is done with Kernel level separation, and very secure. Hackers who want to get your data who use a 0day sandbox breaking exploit really deserve your data. If they can do this they’re basically the elite of hackers. Most stuff will be simple crypto trojans and credential stealers, focused at Windows, which are both stopped dead in their tracks by sandboxing. Let’s say you get 99.9% safety against your specific threat model with sandboxing. If you have 1000 exploits, one might be able to break it, good luck finding 1000 exploits in pirated games even if you try to collect them. And with VMs you might have 99.99% safety but so much less performance and so much more hassle it’s not worth it. There are lower hanging fruits to hack you at that point. In reality there might be an even lower likelyhood of Windows games breaking out of a sandbox or VM on Linux. I have never even read about something like that happening once.

Open ##3790921
@zazarpro@lemmy.ml 2026-07-15 12:03

Just so you know Firejail is a setuid root binary with a lot of code. This means that if that code gets exploited and the sandboxed process escapes the sandbox it will have root privileges instead of the running users. Sources: github.com/netblue30/firejail, madaidans-insecurities.github.io/linux.html#firej…

Open ##3831452