Add new config option to disable U2F in browsers, enabled by default

7 files changed, 17 insertions, 3 deletions

diff --git a/etc/chromium-common.profile b/etc/chromium-common.profile
index e7062c5b8..13ed13058 100644
--- a/etc/chromium-common.profile
+++ b/etc/chromium-common.profile
@@ -27,7 +27,7 @@ nodbus
 nodvd
 nogroups
 notv
-nou2f
+?BROWSER_DISABLE_U2F: nou2f
 shell none
 
 disable-mnt
diff --git a/etc/firefox-common.profile b/etc/firefox-common.profile
index 31b071fe1..722a398cb 100644
--- a/etc/firefox-common.profile
+++ b/etc/firefox-common.profile
@@ -37,7 +37,7 @@ nogroups
 nonewprivs
 noroot
 notv
-nou2f
+?BROWSER_DISABLE_U2F: nou2f
 protocol unix,inet,inet6,netlink
 seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice
 shell none
diff --git a/etc/firejail.config b/etc/firejail.config
index d7106e76c..00f2c1b5d 100644
--- a/etc/firejail.config
+++ b/etc/firejail.config
@@ -5,6 +5,9 @@
 # Enable AppArmor functionality, default enabled.
 # apparmor yes
 
+# Disable U2F in browsers, default enabled.
+# browser-disable-u2f yes
+
 # Number of ARP probes sent when assigning an IP address for --net option,
 # default 2. This is a partial implementation of RFC 5227. A 0.5 seconds
 # timeout is implemented for each probe. Increase this number to 4 if your
diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index 50f952e91..45e28fe40 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -371,6 +371,15 @@ int checkcfg(int val) {
                                 else
                                         goto errout;
                         }
+                        // browser-disable-u2f
+                        else if (strncmp(ptr, "browser-disable-u2f ", 20) == 0) {
+                                if (strcmp(ptr + 20, "yes") == 0)
+                                        cfg_val[CFG_BROWSER_DISABLE_U2F] = 1;
+                                else if (strcmp(ptr + 20, "no") == 0)
+                                        cfg_val[CFG_BROWSER_DISABLE_U2F] = 0;
+                                else
+                                        goto errout;
+                        }
                         else
                                 goto errout;
 
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 7f6ed2586..d996e1dac 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -771,6 +771,7 @@ enum {
         CFG_JOIN,
         CFG_ARP_PROBES,
         CFG_XPRA_ATTACH,
+        CFG_BROWSER_DISABLE_U2F,
         CFG_PRIVATE_LIB,
         CFG_APPARMOR,
         CFG_DBUS,
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index c7c8fd9fa..a85c8f815 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -139,6 +139,7 @@ int profile_check_conditional(char *ptr, int lineno, const char *fname) {
                 bool value;     // true if set
         } conditionals[] = {
                 {"HAS_APPIMAGE", strlen("HAS_APPIMAGE"), arg_appimage!=0},
+                {"BROWSER_DISABLE_U2F", strlen("BROWSER_DISABLE_U2F"), checkcfg(CFG_BROWSER_DISABLE_U2F)!=0},
                 NULL
         }, *cond = conditionals;
         char *tmp = ptr, *msg = NULL;
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index e26b5f989..251346bd5 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -94,7 +94,7 @@ Example: "?HAS_APPIMAGE: whitelist ${HOME}/special/appimage/dir"
 
 This example will load the whitelist profile line only if the \-\-appimage option has been specified on the command line.
 
-Currently the only conditional supported is HAS_APPIMAGE.
+Currently the only conditionals supported are HAS_APPIMAGE and BROWSER_DISABLE_U2F.
 
 The profile line may be any profile line that you would normally use in a profile \fBexcept\fR for "quiet" and "include" lines.