Antimony

⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣰⣦ 
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣴⠟⠹⣧⡀
⠀⠀⠀⠀⠀⠀⠀⠀⣷⣦⣄⣠⣿⠃⢠⣄⠈⢻⣆⣠⣴⡞⡆
⠀⠀⠀⠀⠀⢀⣀⣀⣿⠀⠈⢻⣇⢀⣾⢟⡄⣸⡿⠋⠀⡇⣇⣀⣀ 
⠀⣤⣤⣤⣀⣱⢻⠚⠻⣧⣀⠀⢹⡿⠃⠈⢻⣟⠀⢀⣤⠧⠓⣹⣟⣀⣤⣤⣤⡀
⠀⠈⠻⣧⠉⠛⣽⠀⠀⠀⠙⣷⡿⠁⠀⠀⠀⢻⣶⠛⠁⠀⠀⡟⠟⠉⣵⡟⠁
⠀⠀⠀⠹⣧⡀⠏⡇⠀⠀⠀⣿⠁⠀⠀⠀⠀⠀⣿⡄⠀⠀⢠⢷⠀⣼⡟ 
⠀⠀⠀⠀⠙⣟⢼⡹⡄⠀⠀⣿⡄⠀⠀⠀⠀⢀⣿⡇⠀⢀⣞⣦⢾⠟
⠀⠠⢶⣿⣛⠛⢒⣭⢻⣶⣤⣹⣿⣤⣀⣀⣠⣾⣟⣠⣔⡛⢫⣐⠛⢛⣻⣶⠆
⠀⠀⠀⠉⣻⡽⠛⠉⠁⠀⠉⢙⣿⠖⠒⠛⠻⣿⡋⠉⠁⠈⠉⠙⢿⣿⠉
⠀⠀⠀⠸⠿⠷⠒⣦⣤⣴⣶⢿⣿⡀⠀⠀⠀⣽⡿⢷⣦⠤⢤⡖⠶⠿⠧
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠛⢿⣦⣴⡾⠟⠁
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⠟

---

Antimony is a fast, powerful, customizable, easy-to-use and secure sandboxing application. Its dynamic dependency resolution and extendable design makes it trivial to sandbox applications and seamlessly integrate in the shell and desktop environment.

Tip

See the Quickstart Guide for how to use Antimony!

Installation

Antimony is available for:

• Debian-Based Distributions (Ubuntu)
• Arch-Based Distributions
• Fedora-Based Distributions

Releases provides packages for both distribution types, which can be installed with your package manager of choice.

Antimony relies on the following runtime-dependencies:

• glibc
• bubblewrap
• xdg-dbus-proxy
• sqlite3
• libseccomp
• libdbus

Compiling

Tip

If you’re using Arch, Antimony is available in the AUR

To compile Antimony, you will need:

• Rust and Cargo, supporting the 2024 Edition.
• gcc
• libseccomp (libseccomp-dev for Debian)
• sqlite (libsqlite3-dev for Debian)
• pkgconf (pkg-config for Debian)
• libdbus (libdbus-1-dev for Debian)

To build, simply execute cargo build --release to generate the required binaries in target/release. If you want shell completions, execute cargo build --release --workspace, then run the target/release/antimony_generator. The completions files will be available in the completions folder.

Packaging

If you want to install Antimony without the help of a package manager, just run the cargo-deploy script. Otherwise, you can use fpm to build a package for your distribution. Simply execute fpm -t package_type to output the package.

You’ll need the following dependencies to run the package script:

• fpm (Recommended through gem install fpm)
• libarchive (libarchive-tools for Debian)
• rpm-build/rpm (To create rpm packages)

If you want to install Antimony manually, there are some considerations you take into account:

1. Antimony expects to be run as SetUID underneath its own dedicated system account. You can create one using useradd -r antimony. This account should only have access to /usr/share/antimony, alongside ownership of the antimony binary. You can set the correct permissions on the binary via:

sudo chown antimony:antimony /usr/bin/antimony
sudo chmod ug+s /usr/bin/antimony

Note

Antimony does not require SetUID to function, all that is required is that the AT_HOME environment variable points to somewhere it has write access. Note, however, that provided a globally accessible home for Antimony can allowed for trivial sandbox compromise by writing to the sandboxes SOF folder. It also allows erroneous modifications to be made to Profiles and Features without Antimony being able to mediate it.

Note

If you intend to use the Lockdown functionality, you will additonally need to create a new antimony-lockdown user and create a dedicated directory for it in $AT_HOME

2. Antimony creates hard-links from the system library folder (/usr/lib and /usr/lib64). Some distributions and hardened kernels enforce the fs.protected_hardlinks sysctl, which denies this.

Warning

If Antimony cannot create hard links, it will default to copies. This has a drastic toll on performance.

3. You should create a folder for Antimony to store configurations and caches. It defaults to /usr/share/antimony.