diff options
author | 2020-11-09 16:08:48 +0000 | |
---|---|---|
committer | 2020-11-09 16:08:48 +0000 | |
commit | 594300374dc15bd704bcb1f2a98b17faef80aa79 (patch) | |
tree | ac1b6d8c80a94f26c82c17ee30c34a1623f9c064 /etc/inc | |
parent | adding test-profiles to ci test (diff) | |
download | firejail-594300374dc15bd704bcb1f2a98b17faef80aa79.tar.gz firejail-594300374dc15bd704bcb1f2a98b17faef80aa79.tar.zst firejail-594300374dc15bd704bcb1f2a98b17faef80aa79.zip |
rework chromium (#3688)
* rework chromium
+ 516d0811 has removed fundamental security features.
(remove caps.drop=all, nonewprivs, noroot, seccomp, protocol; add
caps.keep)
Though this is only necessary if running under a kernel which
disallow
unprivileged userns clones. Arch's linux-hardened and debian kernel
are
patched accordingly. Arch's linux and linux-lts kernels support this
restriction via sysctk (kernel.unprivileged_userns_clone=0) as users
opt-in.
Other kernels such as mainline or fedora/redhat always support
unprivileged
userns clone and have no sysctl parameter to disable it. Debian and
Arch
users can enable it with 'sysctl kernel.unprivileged_userns_clone=1'.
This commit adds a chromium-common-hardened.inc which can be included
in
chromium-common to enhance security of chromium-based programs.
+ chromium-common.profile: add private-cache
+ chromium-common.profile: add wruc and wusc, but disable it for the
following
profiles until tested. tests welcome.
- [ ] bnox, dnox, enox, inox, snox
- [ ] brave
- [ ] flashpeak-slimjet
- [ ] google-chrome, google-chrome-beta, google-chrome-unstable
- [ ] iridium
- [ ] min
- [ ] opera, opera-beta
+ move vivaldi-snapshot paths from vivaldi-snapshot.profile to vivaldi.
/usr/bin/vivaldi is a symlink to /etc/alternatives/vivaldi which can
be
vivaldi-stable, vivaldi-beta or vivaldi-snapshot.
vivaldi-snapshot.profile
missed also some features from vivaldi.profile, solve this by making
it
redirect to vivaldi.profile. TODO: exist new paths such as
.local/lib/vivaldi
also for vivaldi-snapshot?
+ create chromium-browser-privacy.profile (closes #3633)
* update 1
+ add missing 'ignore whitelist /usr/share/chromium'
+ revert 'Move drm-relaktions in vivaldi.profile behind
BROWSER_ALLOW_DRM.'. This breaks not just DRM, it break things such
as AAC too. In addition vivaldi shows a something is broken pop-up,
we would have a lot of 'does not work with firejail' issues.
* update 2
* update 3
fixes #3709
Diffstat (limited to 'etc/inc')
-rw-r--r-- | etc/inc/chromium-common-hardened.inc | 5 | ||||
-rw-r--r-- | etc/inc/disable-programs.inc | 2 |
2 files changed, 7 insertions, 0 deletions
diff --git a/etc/inc/chromium-common-hardened.inc b/etc/inc/chromium-common-hardened.inc new file mode 100644 index 000000000..f33ce3115 --- /dev/null +++ b/etc/inc/chromium-common-hardened.inc | |||
@@ -0,0 +1,5 @@ | |||
1 | caps.drop all | ||
2 | nonewprivs | ||
3 | noroot | ||
4 | protocol unix,inet,inet6,netlink | ||
5 | seccomp !chroot | ||
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc index 1fba79f43..7e3c0b657 100644 --- a/etc/inc/disable-programs.inc +++ b/etc/inc/disable-programs.inc | |||
@@ -391,6 +391,7 @@ blacklist ${HOME}/.config/transmission | |||
391 | blacklist ${HOME}/.config/truecraft | 391 | blacklist ${HOME}/.config/truecraft |
392 | blacklist ${HOME}/.config/tvbrowser | 392 | blacklist ${HOME}/.config/tvbrowser |
393 | blacklist ${HOME}/.config/uGet | 393 | blacklist ${HOME}/.config/uGet |
394 | blacklist ${HOME}/.config/ungoogled-chromium | ||
394 | blacklist ${HOME}/.config/uzbl | 395 | blacklist ${HOME}/.config/uzbl |
395 | blacklist ${HOME}/.config/viewnior | 396 | blacklist ${HOME}/.config/viewnior |
396 | blacklist ${HOME}/.config/vivaldi | 397 | blacklist ${HOME}/.config/vivaldi |
@@ -977,6 +978,7 @@ blacklist ${HOME}/.cache/telepathy | |||
977 | blacklist ${HOME}/.cache/thunderbird | 978 | blacklist ${HOME}/.cache/thunderbird |
978 | blacklist ${HOME}/.cache/torbrowser | 979 | blacklist ${HOME}/.cache/torbrowser |
979 | blacklist ${HOME}/.cache/transmission | 980 | blacklist ${HOME}/.cache/transmission |
981 | blacklist ${HOME}/.cache/ungoogled-chromium | ||
980 | blacklist ${HOME}/.cache/vivaldi | 982 | blacklist ${HOME}/.cache/vivaldi |
981 | blacklist ${HOME}/.cache/vivaldi-snapshot | 983 | blacklist ${HOME}/.cache/vivaldi-snapshot |
982 | blacklist ${HOME}/.cache/vlc | 984 | blacklist ${HOME}/.cache/vlc |