diff options
author | rusty-snake <41237666+rusty-snake@users.noreply.github.com> | 2020-11-09 16:08:48 +0000 |
---|---|---|
committer | GitHub <noreply@github.com> | 2020-11-09 16:08:48 +0000 |
commit | 594300374dc15bd704bcb1f2a98b17faef80aa79 (patch) | |
tree | ac1b6d8c80a94f26c82c17ee30c34a1623f9c064 /src | |
parent | adding test-profiles to ci test (diff) | |
download | firejail-594300374dc15bd704bcb1f2a98b17faef80aa79.tar.gz firejail-594300374dc15bd704bcb1f2a98b17faef80aa79.tar.zst firejail-594300374dc15bd704bcb1f2a98b17faef80aa79.zip |
rework chromium (#3688)
* rework chromium
+ 516d0811 has removed fundamental security features.
(remove caps.drop=all, nonewprivs, noroot, seccomp, protocol; add
caps.keep)
Though this is only necessary if running under a kernel which
disallow
unprivileged userns clones. Arch's linux-hardened and debian kernel
are
patched accordingly. Arch's linux and linux-lts kernels support this
restriction via sysctk (kernel.unprivileged_userns_clone=0) as users
opt-in.
Other kernels such as mainline or fedora/redhat always support
unprivileged
userns clone and have no sysctl parameter to disable it. Debian and
Arch
users can enable it with 'sysctl kernel.unprivileged_userns_clone=1'.
This commit adds a chromium-common-hardened.inc which can be included
in
chromium-common to enhance security of chromium-based programs.
+ chromium-common.profile: add private-cache
+ chromium-common.profile: add wruc and wusc, but disable it for the
following
profiles until tested. tests welcome.
- [ ] bnox, dnox, enox, inox, snox
- [ ] brave
- [ ] flashpeak-slimjet
- [ ] google-chrome, google-chrome-beta, google-chrome-unstable
- [ ] iridium
- [ ] min
- [ ] opera, opera-beta
+ move vivaldi-snapshot paths from vivaldi-snapshot.profile to vivaldi.
/usr/bin/vivaldi is a symlink to /etc/alternatives/vivaldi which can
be
vivaldi-stable, vivaldi-beta or vivaldi-snapshot.
vivaldi-snapshot.profile
missed also some features from vivaldi.profile, solve this by making
it
redirect to vivaldi.profile. TODO: exist new paths such as
.local/lib/vivaldi
also for vivaldi-snapshot?
+ create chromium-browser-privacy.profile (closes #3633)
* update 1
+ add missing 'ignore whitelist /usr/share/chromium'
+ revert 'Move drm-relaktions in vivaldi.profile behind
BROWSER_ALLOW_DRM.'. This breaks not just DRM, it break things such
as AAC too. In addition vivaldi shows a something is broken pop-up,
we would have a lot of 'does not work with firejail' issues.
* update 2
* update 3
fixes #3709
Diffstat (limited to 'src')
-rw-r--r-- | src/firecfg/firecfg.config | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config index e41ed32b3..b0a223911 100644 --- a/src/firecfg/firecfg.config +++ b/src/firecfg/firecfg.config | |||
@@ -119,6 +119,7 @@ cheese | |||
119 | cherrytree | 119 | cherrytree |
120 | chromium | 120 | chromium |
121 | chromium-browser | 121 | chromium-browser |
122 | chromium-browser-privacy | ||
122 | chromium-freeworld | 123 | chromium-freeworld |
123 | cin | 124 | cin |
124 | cinelerra | 125 | cinelerra |