private-lib: can we mount instead of copy?

[smitsohu]

While in general private options copy files in the sandbox instead of mounting them, there are two exceptions to the rule:

• private-tmp, which mounts a set of paths in the sandbox in order to provide essential sockets

• private-lib, which currently employs a mix of copying and mounting: files are copied and directories are mounted

I would propose to move all of private-lib to mounts, mainly for performance reasons. For example it takes Firejail seconds to configure the sandbox firejail --noprofile --private-lib kcalc, even on a rather powerful notebook. On legacy hardware it can be ten seconds and more. Switching from copying to mounting accelerates sandbox setup by about an order of magnitude.

Resolving the inconsistency in the other direction, that is copy everything and mount nothing, is probably not going to work because of excessive RAM demand. Also it would slow down private-lib even more.

[reinerh]

Mounting read-only?

[smitsohu]

@reinerh If we remove the read-only flag, it would tear holes in Firejail's basic read-only file system. So read-only would be best, I guess.

[reinerh]

Okay, thanks. Just wanted to clarify if it gets mounted read-only.

[netblue30]

Yes, I think we should clean it up and make it mount-only..