From 62e33cfc37635d985c186c8e5aaf1101070f9ccf Mon Sep 17 00:00:00 2001 From: netblue30 Date: Thu, 21 Apr 2022 11:41:40 -0400 Subject: more on firecfg --guide --- src/firecfg/firejail-welcome.sh | 217 +++++++++++++++++++++++++++------------- src/firecfg/main.c | 19 +++- 2 files changed, 162 insertions(+), 74 deletions(-) diff --git a/src/firecfg/firejail-welcome.sh b/src/firecfg/firejail-welcome.sh index c9b6c450b..a3e9713e4 100755 --- a/src/firecfg/firejail-welcome.sh +++ b/src/firecfg/firejail-welcome.sh @@ -3,126 +3,203 @@ # This file is part of Firejail project # Copyright (C) 2020-2022 Firejail Authors # License GPL v2 - -if ! command -v zenity >/dev/null; then - echo "Please install zenity." - exit 1 -fi -if ! command -v sudo >/dev/null; then - echo "Please install sudo." +# +# Usage: firejail-welcome PROGRAM SYSCONFDIR +# where PROGRAM is detected and driven by firecfg. +# SYSCONFDIR is most of the time /etc/firejail. +# +# The plan is to go with zenity by default. If zenity is not installed +# we will provide a console-only replacement in /usr/lib/firejail/fzenity +# + +PROGRAM=$1 +SYSCONFDIR=$2 + +if ! command -v $PROGRAM >/dev/null; then + echo "Please install $PROGRAM." exit 1 fi export LANG=en_US.UTF8 -zenity --title=firejail-welcome.sh --text-info --width=750 --height=500 <Welcome to Firejail! -Profiles for programs can be found in /etc/firejail. Own customizations should go in a file named -.local in ~/.config/firejal. -Firejail's own configuration can be found at /etc/firejail/firejail.config. +This guide will walk you through some of the most common sandbox customizations. At the end of the guide you'll have the option to save your changes in Firejail's global config file at /etc/firejail/firejail.config. A copy of the original file is stored as /etc/firejal/firejail.config-. -Please note that running this script a second time can set new options, but does not unset options -set in a previous run. +Please note that running this script a second time can set new options, but does not clear options set in a previous run. -Website: https://firejail.wordpress.com -Bug-Tracker: https://github.com/netblue30/firejail/issues -Documentation: -- https://github.com/netblue30/firejail/wiki -- https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions -- https://firejail.wordpress.com/documentation-2 -- man:firejail(1) and man:firejail-profile(5) +Press OK to continue, or close this window to stop the program. -PS: If you have any improvements for this script, open an issue or pull request. EOM +$PROGRAM --title="$TITLE" --info --width=600 --height=40 --text="$MSG_INTRO" [[ $? -eq 1 ]] && exit 0 -sed_scripts=() +#****************************************************** +# symlinks +#****************************************************** +read -r -d $'\0' MSG_Q_RUN_FIRECFG <Should most programs be sandboxed by default? + +Currently, Firejail recognizes more than 1000 regular desktop programs. These programs +can be sandboxed automatically when you start them. + +EOM + +if $PROGRAM --title="$TITLE" --question --ellipsize --text="$MSG_Q_RUN_FIRECFG"; then + run_firecfg=true +fi +[[ $? -eq 1 ]] && exit 0 +#****************************************************** +# U2F +#****************************************************** read -r -d $'\0' MSG_Q_BROWSER_DISABLE_U2F <Should browsers be allowed to access u2f hardware? + +Universal Two-Factor (U2F) devices are used as a password store for online +accounts. These devices usually come in a form of a USB key. + EOM +if $PROGRAM --title="$TITLE" --question --ellipsize --text="$MSG_Q_BROWSER_DISABLE_U2F"; then + enable_u2f=true + sed_scripts+=("-e s/# browser-disable-u2f yes/browser-disable-u2f no/") +fi + +#****************************************************** +# DRM +#****************************************************** read -r -d $'\0' MSG_Q_BROWSER_ALLOW_DRM <Should browsers be able to play DRM content? -\$HOME is noexec,nodev,nosuid by default for the most sandboxes. This means that executing programs which are located in \$HOME, -is forbidden, the setuid attribute on files is ignored and device files inside \$HOME don't work. Browsers install proprietary -DRM plug-ins such as Widevine under \$HOME by default. In order to use them, \$HOME must be mounted exec inside the sandbox to -allow their execution. Clearly, this may help an attacker to start malicious code. +The home directory is noexec,nodev,nosuid by default for most applications. +This means that executing programs located in your home directory is forbidden. + +Browsers install proprietary DRM plug-ins such as Widevine in your home directory. +In order to use them, your home must be mounted exec inside the sandbox. This +may give the people developing and distributing the plug-in access to your private +data. -NOTE: Other software written in an interpreter language such as bash, python or java can always be started from \$HOME. +NOTE: Software written in an interpreted language such as bash, python or java can +always be started from home directory. HINT: If /home has its own partition, you can mount it nodev,nosuid for all programs. -EOM -read -r -d $'\0' MSG_L_ADVANCED_OPTIONS <Should most programs be started in firejail by default? -EOM +if $PROGRAM --title="$TITLE" --question --ellipsize --text="$MSG_Q_BROWSER_ALLOW_DRM"; then + enable_drm=true + sed_scripts+=("-e s/# browser-allow-drm no/browser-allow-drm yes/") +fi + +#****************************************************** +# nonewprivs +#****************************************************** +read -r -d $'\0' MSG_Q_NONEWPRIVS <Should we force nonweprivs by default? + +nonewprivs is a Linux kernel feature that prevents programs from rising privileges. +It is also a strong mitigation against exploits in Firejail. However, some programs +like chromium, wireshark, or even ping might not work. + +NOTE: seccomp enables nonewprivs automatically. Most applications supported by +default by Firejail are using seccomp. -read -r -d $'\0' MSG_I_ROOT_REQUIRED <Should we restrict network functionality? + +Restrict all network related commands except 'net none' to root only. + EOM -if zenity --title=firejail-welcome.sh --question --ellipsize --text="$MSG_Q_BROWSER_DISABLE_U2F"; then - sed_scripts+=("-e s/# browser-disable-u2f yes/browser-disable-u2f no/") +if $PROGRAM --title="$TITLE" --question --ellipsize --text="$MSG_Q_NETWORK"; then + enable_restricted_net=true + sed_scripts+=("-e s/# restricted-network no/restricted-network yes/") fi -if zenity --title=firejail-welcome.sh --question --ellipsize --text="$MSG_Q_BROWSER_ALLOW_DRM"; then - sed_scripts+=("-e s/# browser-allow-drm no/browser-allow-drm yes/") +#****************************************************** +# seccomp kill +#****************************************************** +read -r -d $'\0' MSG_Q_SECCOMP <Should we kill programs that violate seccomp rules? + +By default seccomp prevents the program from running the syscall and returns an error. + +EOM + +if $PROGRAM --title="$TITLE" --question --ellipsize --text="$MSG_Q_SECCOMP"; then + enable_seccomp_kill=true + sed_scripts+=("-e s/# seccomp-error-action EPERM/seccomp-error-action kill/") fi -advanced_options=$(zenity --title=firejail-welcome.sh --list --width=800 --height=200 \ - --text="$MSG_L_ADVANCED_OPTIONS" --multiple --checklist --separator=" " \ - --column="" --column=Option --column=Description <