jails Is It a Flatpak? Is It an AppImage? No! It's AppJail!

[DtxdF]

Finally, after a few months of experimentation, this week I decided to create a new tool based on what I've learned. And best of all: to honor the name of the main project, AppJail.

Initially, x11appjail was a project designed to leverage appjail-x11(1), an AppJail command for deploying an X server to run X11 applications inside a jail. However, this could be considered a "low-level" command, since executing an interactive application (TUI, CLI, GUI, etc.) requires completing specific stages for which this command is not designed. In the new version of x11appjail, these stages are documented in x11appjail-spec(5) but, in summary, they are: create, X, install, uninstall, and run.

To create a tool suitable for real-world use, I also had to improve some of the projects x11appjail depends on, such as appscript and unixexec. The following key improvements are worth noting:

• My goal with appscript is to create an ultra-lightweight alternative to AppImage for FreeBSD that does not rely on FUSE (thereby avoiding the need to configure vfs.usermount=1). In previous versions, the SFX would decompress its contents into a random directory upon every execution. This negatively impacts performance if the content is large. In the new version of appscript, processes operate cooperatively using exclusive and shared locks; consequently, the content is extracted only once (by the main or "leader" process) and removed only once (when the final process terminates).
  
  This is crucial for the new version of x11appjail, as it creates an AppJail from a specific AppJail image containing the application and its dependencies, which can result in a large AppJail in certain cases (i.e.: firefox).
• I take a more paranoid approach in this regard; therefore, one of the improvements made to unixexec is an option to not follow symlinks, given that using services (see SERVICES in x11appjail(1)) creates a unix(4) socket from the host to the jail.
• Another improvement to appscript is the ability to sign and verify AppScripts using the signify and sha256. This addition is essential, as x11appjail utilizes this functionality when running AppJails in portable mode.

After all this, and much more, the x11appjail tool was born:

x11appjail is a specialized tool for creating, verifying, installing, and running AppJails. An AppJail is a CLI, TUI or X11 application that runs inside a FreeBSD jail but is perceived by the end user as identical (or at least very similar) to an application running directly on the host system.

This tool makes extensive use of appjail(1) as its engine; however, unlike the latter, the primary user in x11appjail is neither root nor a privileged user, but rather an unprivileged user. The fundamental goal of this project is to grant the user limited access to the jail, restricted solely to the execution of a CLI, TUI or X11 application.

Project: https://github.com/DtxdF/x11appjail Port: https://freshports.org/security/x11appjail

Note: Keep in mind that this project requires the latest versions of appscript, unixexec, and appjail.