I am looking at running Jitsi on Debian. For security reasons, I want to isolate Jitsi from the rest of the system. I could use a VM, but I want a lighter solution. So I looked at sudo/pkexec vs. Firefail.
For pkexec, this is what I've done:
useradd --system -s /usr/sbin/nologin -d /home/jitsi jitsi pkexec -u jitsi env DISPLAY=$DISPLAY XAUTHORITY=$XAUTHORITY /usr/bin/jitsi %u
I've adjusted iptables for the user jitsi
This works except for the warning:
"could not determine how to handle %u"
Note: If I remove %u the command doesn't work at all and Jitsi freezes while loading.
The other approach is to use Firejail as in
$ firejail jitsi
I chose firejail because it advertises itself for its security versus other containers.
Firejail doesn't seem to work with Jitsi, but let's ignore this for the moment.
What are the differences from a security standpoint between the two approches. What are the pros and cons of sudo/pkexec to a system user versus sandboxing using Firejail? I would appreciate some clarification on this subject.