diff options
author | 2020-11-09 16:08:48 +0000 | |
---|---|---|
committer | 2020-11-09 16:08:48 +0000 | |
commit | 594300374dc15bd704bcb1f2a98b17faef80aa79 (patch) | |
tree | ac1b6d8c80a94f26c82c17ee30c34a1623f9c064 /etc/profile-m-z | |
parent | adding test-profiles to ci test (diff) | |
download | firejail-594300374dc15bd704bcb1f2a98b17faef80aa79.tar.gz firejail-594300374dc15bd704bcb1f2a98b17faef80aa79.tar.zst firejail-594300374dc15bd704bcb1f2a98b17faef80aa79.zip |
rework chromium (#3688)
* rework chromium
+ 516d0811 has removed fundamental security features.
(remove caps.drop=all, nonewprivs, noroot, seccomp, protocol; add
caps.keep)
Though this is only necessary if running under a kernel which
disallow
unprivileged userns clones. Arch's linux-hardened and debian kernel
are
patched accordingly. Arch's linux and linux-lts kernels support this
restriction via sysctk (kernel.unprivileged_userns_clone=0) as users
opt-in.
Other kernels such as mainline or fedora/redhat always support
unprivileged
userns clone and have no sysctl parameter to disable it. Debian and
Arch
users can enable it with 'sysctl kernel.unprivileged_userns_clone=1'.
This commit adds a chromium-common-hardened.inc which can be included
in
chromium-common to enhance security of chromium-based programs.
+ chromium-common.profile: add private-cache
+ chromium-common.profile: add wruc and wusc, but disable it for the
following
profiles until tested. tests welcome.
- [ ] bnox, dnox, enox, inox, snox
- [ ] brave
- [ ] flashpeak-slimjet
- [ ] google-chrome, google-chrome-beta, google-chrome-unstable
- [ ] iridium
- [ ] min
- [ ] opera, opera-beta
+ move vivaldi-snapshot paths from vivaldi-snapshot.profile to vivaldi.
/usr/bin/vivaldi is a symlink to /etc/alternatives/vivaldi which can
be
vivaldi-stable, vivaldi-beta or vivaldi-snapshot.
vivaldi-snapshot.profile
missed also some features from vivaldi.profile, solve this by making
it
redirect to vivaldi.profile. TODO: exist new paths such as
.local/lib/vivaldi
also for vivaldi-snapshot?
+ create chromium-browser-privacy.profile (closes #3633)
* update 1
+ add missing 'ignore whitelist /usr/share/chromium'
+ revert 'Move drm-relaktions in vivaldi.profile behind
BROWSER_ALLOW_DRM.'. This breaks not just DRM, it break things such
as AAC too. In addition vivaldi shows a something is broken pop-up,
we would have a lot of 'does not work with firejail' issues.
* update 2
* update 3
fixes #3709
Diffstat (limited to 'etc/profile-m-z')
-rw-r--r-- | etc/profile-m-z/min.profile | 5 | ||||
-rw-r--r-- | etc/profile-m-z/opera-beta.profile | 5 | ||||
-rw-r--r-- | etc/profile-m-z/opera.profile | 5 | ||||
-rw-r--r-- | etc/profile-m-z/snox.profile | 5 | ||||
-rw-r--r-- | etc/profile-m-z/vivaldi-beta.profile | 4 | ||||
-rw-r--r-- | etc/profile-m-z/vivaldi-snapshot.profile | 12 | ||||
-rw-r--r-- | etc/profile-m-z/vivaldi-stable.profile | 4 | ||||
-rw-r--r-- | etc/profile-m-z/vivaldi.profile | 6 | ||||
-rw-r--r-- | etc/profile-m-z/yandex-browser.profile | 5 |
9 files changed, 38 insertions, 13 deletions
diff --git a/etc/profile-m-z/min.profile b/etc/profile-m-z/min.profile index 7f3aeab44..5dac50cd8 100644 --- a/etc/profile-m-z/min.profile +++ b/etc/profile-m-z/min.profile | |||
@@ -6,6 +6,11 @@ include min.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Disable for now, see https://github.com/netblue30/firejail/pull/3688#issuecomment-718711565 | ||
10 | ignore whitelist /usr/share/chromium | ||
11 | ignore include whitelist-runuser-common.inc | ||
12 | ignore include whitelist-usr-share-common.inc | ||
13 | |||
9 | noblacklist ${HOME}/.config/Min | 14 | noblacklist ${HOME}/.config/Min |
10 | 15 | ||
11 | mkdir ${HOME}/.config/Min | 16 | mkdir ${HOME}/.config/Min |
diff --git a/etc/profile-m-z/opera-beta.profile b/etc/profile-m-z/opera-beta.profile index 8658d30c6..551f1aba4 100644 --- a/etc/profile-m-z/opera-beta.profile +++ b/etc/profile-m-z/opera-beta.profile | |||
@@ -5,6 +5,11 @@ include opera-beta.local | |||
5 | # Persistent global definitions | 5 | # Persistent global definitions |
6 | include globals.local | 6 | include globals.local |
7 | 7 | ||
8 | # Disable for now, see https://www.tutorialspoint.com/difference-between-void-main-and-int-main-in-c-cplusplus | ||
9 | ignore whitelist /usr/share/chromium | ||
10 | ignore include whitelist-runuser-common.inc | ||
11 | ignore include whitelist-usr-share-common.inc | ||
12 | |||
8 | noblacklist ${HOME}/.cache/opera | 13 | noblacklist ${HOME}/.cache/opera |
9 | noblacklist ${HOME}/.config/opera-beta | 14 | noblacklist ${HOME}/.config/opera-beta |
10 | 15 | ||
diff --git a/etc/profile-m-z/opera.profile b/etc/profile-m-z/opera.profile index b342b3961..2c7c5fc35 100644 --- a/etc/profile-m-z/opera.profile +++ b/etc/profile-m-z/opera.profile | |||
@@ -6,6 +6,11 @@ include opera.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Disable for now, see https://www.tutorialspoint.com/difference-between-void-main-and-int-main-in-c-cplusplus | ||
10 | ignore whitelist /usr/share/chromium | ||
11 | ignore include whitelist-runuser-common.inc | ||
12 | ignore include whitelist-usr-share-common.inc | ||
13 | |||
9 | noblacklist ${HOME}/.cache/opera | 14 | noblacklist ${HOME}/.cache/opera |
10 | noblacklist ${HOME}/.config/opera | 15 | noblacklist ${HOME}/.config/opera |
11 | noblacklist ${HOME}/.opera | 16 | noblacklist ${HOME}/.opera |
diff --git a/etc/profile-m-z/snox.profile b/etc/profile-m-z/snox.profile index 3b3fd1ae1..83493652c 100644 --- a/etc/profile-m-z/snox.profile +++ b/etc/profile-m-z/snox.profile | |||
@@ -5,6 +5,11 @@ include snox.local | |||
5 | # Persistent global definitions | 5 | # Persistent global definitions |
6 | include globals.local | 6 | include globals.local |
7 | 7 | ||
8 | # Disable for now, see https://www.tutorialspoint.com/difference-between-void-main-and-int-main-in-c-cplusplus | ||
9 | ignore whitelist /usr/share/chromium | ||
10 | ignore include whitelist-runuser-common.inc | ||
11 | ignore include whitelist-usr-share-common.inc | ||
12 | |||
8 | noblacklist ${HOME}/.cache/snox | 13 | noblacklist ${HOME}/.cache/snox |
9 | noblacklist ${HOME}/.config/snox | 14 | noblacklist ${HOME}/.config/snox |
10 | 15 | ||
diff --git a/etc/profile-m-z/vivaldi-beta.profile b/etc/profile-m-z/vivaldi-beta.profile index 5de5682a3..0d80167f3 100644 --- a/etc/profile-m-z/vivaldi-beta.profile +++ b/etc/profile-m-z/vivaldi-beta.profile | |||
@@ -1,5 +1,7 @@ | |||
1 | # Firejail profile alias for vivaldi | 1 | # Firejail profile for vivaldi-beta |
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | # Persistent local customizations | ||
4 | include vivaldi-beta.local | ||
3 | 5 | ||
4 | # Redirect | 6 | # Redirect |
5 | include vivaldi.profile | 7 | include vivaldi.profile |
diff --git a/etc/profile-m-z/vivaldi-snapshot.profile b/etc/profile-m-z/vivaldi-snapshot.profile index ea4a4009f..543f206af 100644 --- a/etc/profile-m-z/vivaldi-snapshot.profile +++ b/etc/profile-m-z/vivaldi-snapshot.profile | |||
@@ -2,16 +2,6 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | # Persistent local customizations | 3 | # Persistent local customizations |
4 | include vivaldi-snapshot.local | 4 | include vivaldi-snapshot.local |
5 | # Persistent global definitions | ||
6 | include globals.local | ||
7 | |||
8 | noblacklist ${HOME}/.cache/vivaldi-snapshot | ||
9 | noblacklist ${HOME}/.config/vivaldi-snapshot | ||
10 | |||
11 | mkdir ${HOME}/.cache/vivaldi-snapshot | ||
12 | mkdir ${HOME}/.config/vivaldi-snapshot | ||
13 | whitelist ${HOME}/.cache/vivaldi-snapshot | ||
14 | whitelist ${HOME}/.config/vivaldi-snapshot | ||
15 | 5 | ||
16 | # Redirect | 6 | # Redirect |
17 | include chromium-common.profile | 7 | include vivaldi.profile |
diff --git a/etc/profile-m-z/vivaldi-stable.profile b/etc/profile-m-z/vivaldi-stable.profile index 5de5682a3..94b2cd76c 100644 --- a/etc/profile-m-z/vivaldi-stable.profile +++ b/etc/profile-m-z/vivaldi-stable.profile | |||
@@ -1,5 +1,7 @@ | |||
1 | # Firejail profile alias for vivaldi | 1 | # Firejail profile for vivaldi-stable |
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | # Persistent local customizations | ||
4 | include vivaldi-stable.local | ||
3 | 5 | ||
4 | # Redirect | 6 | # Redirect |
5 | include vivaldi.profile | 7 | include vivaldi.profile |
diff --git a/etc/profile-m-z/vivaldi.profile b/etc/profile-m-z/vivaldi.profile index 096ce8a72..541942453 100644 --- a/etc/profile-m-z/vivaldi.profile +++ b/etc/profile-m-z/vivaldi.profile | |||
@@ -13,14 +13,20 @@ whitelist /var/opt/vivaldi | |||
13 | writable-var | 13 | writable-var |
14 | 14 | ||
15 | noblacklist ${HOME}/.cache/vivaldi | 15 | noblacklist ${HOME}/.cache/vivaldi |
16 | noblacklist ${HOME}/.cache/vivaldi-snapshot | ||
16 | noblacklist ${HOME}/.config/vivaldi | 17 | noblacklist ${HOME}/.config/vivaldi |
18 | noblacklist ${HOME}/.config/vivaldi-snapshot | ||
17 | noblacklist ${HOME}/.local/lib/vivaldi | 19 | noblacklist ${HOME}/.local/lib/vivaldi |
18 | 20 | ||
19 | mkdir ${HOME}/.cache/vivaldi | 21 | mkdir ${HOME}/.cache/vivaldi |
22 | mkdir ${HOME}/.cache/vivaldi-snapshot | ||
20 | mkdir ${HOME}/.config/vivaldi | 23 | mkdir ${HOME}/.config/vivaldi |
24 | mkdir ${HOME}/.config/vivaldi-snapshot | ||
21 | mkdir ${HOME}/.local/lib/vivaldi | 25 | mkdir ${HOME}/.local/lib/vivaldi |
22 | whitelist ${HOME}/.cache/vivaldi | 26 | whitelist ${HOME}/.cache/vivaldi |
27 | whitelist ${HOME}/.cache/vivaldi-snapshot | ||
23 | whitelist ${HOME}/.config/vivaldi | 28 | whitelist ${HOME}/.config/vivaldi |
29 | whitelist ${HOME}/.config/vivaldi-snapshot | ||
24 | whitelist ${HOME}/.local/lib/vivaldi | 30 | whitelist ${HOME}/.local/lib/vivaldi |
25 | 31 | ||
26 | # breaks vivaldi sync | 32 | # breaks vivaldi sync |
diff --git a/etc/profile-m-z/yandex-browser.profile b/etc/profile-m-z/yandex-browser.profile index 680bef677..81cd021f7 100644 --- a/etc/profile-m-z/yandex-browser.profile +++ b/etc/profile-m-z/yandex-browser.profile | |||
@@ -5,6 +5,11 @@ include yandex-browser.local | |||
5 | # Persistent global definitions | 5 | # Persistent global definitions |
6 | include globals.local | 6 | include globals.local |
7 | 7 | ||
8 | # Disable for now, see https://www.tutorialspoint.com/difference-between-void-main-and-int-main-in-c-cplusplus | ||
9 | ignore whitelist /usr/share/chromium | ||
10 | ignore include whitelist-runuser-common.inc | ||
11 | ignore include whitelist-usr-share-common.inc | ||
12 | |||
8 | noblacklist ${HOME}/.cache/yandex-browser | 13 | noblacklist ${HOME}/.cache/yandex-browser |
9 | noblacklist ${HOME}/.cache/yandex-browser-beta | 14 | noblacklist ${HOME}/.cache/yandex-browser-beta |
10 | noblacklist ${HOME}/.config/yandex-browser | 15 | noblacklist ${HOME}/.config/yandex-browser |