Skip to content

Commit

Permalink
more on firecfg --guide
Browse files Browse the repository at this point in the history
  • Loading branch information
@netblue30
netblue30 committed Apr 21, 2022
1 parent 0cfb641 commit 62e33cf
Show file tree
Hide file tree
Showing 2 changed files with 162 additions and 74 deletions.
217 changes: 147 additions & 70 deletions src/firecfg/firejail-welcome.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,126 +3,203 @@
# This file is part of Firejail project
# Copyright (C) 2020-2022 Firejail Authors
# License GPL v2

if ! command -v zenity >/dev/null; then
echo "Please install zenity."
exit 1
fi
if ! command -v sudo >/dev/null; then
echo "Please install sudo."
#
# Usage: firejail-welcome PROGRAM SYSCONFDIR
# where PROGRAM is detected and driven by firecfg.
# SYSCONFDIR is most of the time /etc/firejail.
#
# The plan is to go with zenity by default. If zenity is not installed
# we will provide a console-only replacement in /usr/lib/firejail/fzenity
#

PROGRAM=$1
SYSCONFDIR=$2

if ! command -v $PROGRAM >/dev/null; then
echo "Please install $PROGRAM."
exit 1
fi

export LANG=en_US.UTF8

zenity --title=firejail-welcome.sh --text-info --width=750 --height=500 <<EOM
Welcome to firejail!
TITLE="Firejail Configuration Guide"
sed_scripts=()
run_firecfg=false
enable_u2f=false
enable_drm=false
enable_seccomp_kill=false
enable_restricted_net=false
enable_nonewprivs=false

This is a quick setup guide for newbies.
#******************************************************
# Intro
#******************************************************
read -r -d $'\0' MSG_INTRO <<EOM
<big><b>Welcome to Firejail!</b></big>
Profiles for programs can be found in /etc/firejail. Own customizations should go in a file named
<profile-name>.local in ~/.config/firejal.
Firejail's own configuration can be found at /etc/firejail/firejail.config.
This guide will walk you through some of the most common sandbox customizations. At the end of the guide you'll have the option to save your changes in Firejail's global config file at <b>/etc/firejail/firejail.config</b>. A copy of the original file is stored as <b>/etc/firejal/firejail.config-</b>.
Please note that running this script a second time can set new options, but does not unset options
set in a previous run.
Please note that running this script a second time can set new options, but does not clear options set in a previous run.
Website: https://firejail.wordpress.com
Bug-Tracker: https://github.com/netblue30/firejail/issues
Documentation:
- https://github.com/netblue30/firejail/wiki
- https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions
- https://firejail.wordpress.com/documentation-2
- man:firejail(1) and man:firejail-profile(5)
Press OK to continue, or close this window to stop the program.
PS: If you have any improvements for this script, open an issue or pull request.
EOM
$PROGRAM --title="$TITLE" --info --width=600 --height=40 --text="$MSG_INTRO"
[[ $? -eq 1 ]] && exit 0

sed_scripts=()
#******************************************************
# symlinks
#******************************************************
read -r -d $'\0' MSG_Q_RUN_FIRECFG <<EOM
<big><b>Should most programs be sandboxed by default?</b></big>
Currently, Firejail recognizes more than 1000 regular desktop programs. These programs
can be sandboxed automatically when you start them.
EOM

if $PROGRAM --title="$TITLE" --question --ellipsize --text="$MSG_Q_RUN_FIRECFG"; then
run_firecfg=true
fi
[[ $? -eq 1 ]] && exit 0

#******************************************************
# U2F
#******************************************************
read -r -d $'\0' MSG_Q_BROWSER_DISABLE_U2F <<EOM
<big><b>Should browsers be allowed to access u2f hardware?</b></big>
Universal Two-Factor (U2F) devices are used as a password store for online
accounts. These devices usually come in a form of a USB key.
EOM

if $PROGRAM --title="$TITLE" --question --ellipsize --text="$MSG_Q_BROWSER_DISABLE_U2F"; then
enable_u2f=true
sed_scripts+=("-e s/# browser-disable-u2f yes/browser-disable-u2f no/")
fi

#******************************************************
# DRM
#******************************************************
read -r -d $'\0' MSG_Q_BROWSER_ALLOW_DRM <<EOM
<big><b>Should browsers be able to play DRM content?</b></big>
\$HOME is noexec,nodev,nosuid by default for the most sandboxes. This means that executing programs which are located in \$HOME,
is forbidden, the setuid attribute on files is ignored and device files inside \$HOME don't work. Browsers install proprietary
DRM plug-ins such as Widevine under \$HOME by default. In order to use them, \$HOME must be mounted exec inside the sandbox to
allow their execution. Clearly, this may help an attacker to start malicious code.
The home directory is <tt>noexec,nodev,nosuid</tt> by default for most applications.
This means that executing programs located in your home directory is forbidden.
Browsers install proprietary DRM plug-ins such as Widevine in your home directory.
In order to use them, your home must be mounted <tt>exec</tt> inside the sandbox. This
may give the people developing and distributing the plug-in access to your private
data.
NOTE: Other software written in an interpreter language such as bash, python or java can always be started from \$HOME.
NOTE: Software written in an interpreted language such as bash, python or java can
always be started from home directory.
HINT: If <tt>/home</tt> has its own partition, you can mount it <tt>nodev,nosuid</tt> for all programs.
EOM
read -r -d $'\0' MSG_L_ADVANCED_OPTIONS <<EOM
You maybe want to set some of these advanced options.
EOM

read -r -d $'\0' MSG_Q_RUN_FIRECFG <<EOM
<big><b>Should most programs be started in firejail by default?</b></big>
EOM
if $PROGRAM --title="$TITLE" --question --ellipsize --text="$MSG_Q_BROWSER_ALLOW_DRM"; then
enable_drm=true
sed_scripts+=("-e s/# browser-allow-drm no/browser-allow-drm yes/")
fi

#******************************************************
# nonewprivs
#******************************************************
read -r -d $'\0' MSG_Q_NONEWPRIVS <<EOM
<big><b>Should we force nonweprivs by default?</b></big>
nonewprivs is a Linux kernel feature that prevents programs from rising privileges.
It is also a strong mitigation against exploits in Firejail. However, some programs
like chromium, wireshark, or even ping might not work.
NOTE: seccomp enables nonewprivs automatically. Most applications supported by
default by Firejail are using seccomp.
read -r -d $'\0' MSG_I_ROOT_REQUIRED <<EOM
In order to apply these changes, root privileges are required.
You will now be asked to enter your password.
EOM

read -r -d $'\0' MSG_I_FINISH <<EOM
🥳
if $PROGRAM --title="$TITLE" --question --ellipsize --text="$MSG_Q_NONEWPRIVS"; then
enable_nonewprivs=true
sed_scripts+=("-e s/# force-nonewprivs no/force-nonewprivs yes/")
fi

#******************************************************
# restricted network
#******************************************************
read -r -d $'\0' MSG_Q_NETWORK <<EOM
<big><b>Should we restrict network functionality?</b></big>
Restrict all network related commands except '<tt>net none</tt>' to root only.
EOM

if zenity --title=firejail-welcome.sh --question --ellipsize --text="$MSG_Q_BROWSER_DISABLE_U2F"; then
sed_scripts+=("-e s/# browser-disable-u2f yes/browser-disable-u2f no/")
if $PROGRAM --title="$TITLE" --question --ellipsize --text="$MSG_Q_NETWORK"; then
enable_restricted_net=true
sed_scripts+=("-e s/# restricted-network no/restricted-network yes/")
fi

if zenity --title=firejail-welcome.sh --question --ellipsize --text="$MSG_Q_BROWSER_ALLOW_DRM"; then
sed_scripts+=("-e s/# browser-allow-drm no/browser-allow-drm yes/")
#******************************************************
# seccomp kill
#******************************************************
read -r -d $'\0' MSG_Q_SECCOMP <<EOM
<big><b>Should we kill programs that violate seccomp rules?</b></big>
By default seccomp prevents the program from running the syscall and returns an error.
EOM

if $PROGRAM --title="$TITLE" --question --ellipsize --text="$MSG_Q_SECCOMP"; then
enable_seccomp_kill=true
sed_scripts+=("-e s/# seccomp-error-action EPERM/seccomp-error-action kill/")
fi

advanced_options=$(zenity --title=firejail-welcome.sh --list --width=800 --height=200 \
--text="$MSG_L_ADVANCED_OPTIONS" --multiple --checklist --separator=" " \
--column="" --column=Option --column=Description <<EOM

force-nonewprivs
Always set nonewprivs, this is a strong mitigation against exploits in firejail. However some programs like chromium or wireshark maybe don't work anymore.

restricted-network
Restrict all network related commands except 'net none' to root only.

seccomp-error-action=kill
Kill programs which violate seccomp rules (default: return a error).
#******************************************************
# root
#******************************************************
read -r -d $'\0' MSG_RUN <<EOM
Now, I will apply the changes. This is what I will do:
EOM
)

if [[ $advanced_options == *force-nonewprivs* ]]; then
sed_scripts+=("-e s/# force-nonewprivs no/force-nonewprivs yes/")
MSG_RUN+="\\n\\n"
if [[ "$run_firecfg" == "true" ]]; then
MSG_RUN+=" * enable Firejail for all recognized programs\\n"
fi
if [[ $advanced_options == *restricted-network* ]]; then
sed_scripts+=("-e s/# restricted-network no/restricted-network yes/")
if [[ "$enable_u2f" == "true" ]]; then
MSG_RUN+=" * allow browsers to access U2F devices\\n"
fi
if [[ $advanced_options == *seccomp-error-action=kill* ]]; then
sed_scripts+=("-e s/# seccomp-error-action EPERM/seccomp-error-action kill/")
if [[ "$enable_drm" == "true" ]]; then
MSG_RUN+=" * allow browsers to play DRM content\\n"
fi

if zenity --title=firejail-welcome.sh --question --ellipsize --text="$MSG_Q_RUN_FIRECFG"; then
run_firecfg=true
if [[ "$enable_nonewprivs" == "true" ]]; then
MSG_RUN+=" * enable nonewprivs globally\\n"
fi
if [[ "$enable_restricted_net" == "true" ]]; then
MSG_RUN+=" * restrict networking features\\n"
fi
if [[ "$enable_seccomp_kill" == "true" ]]; then
MSG_RUN+=" * enable seccomp kill\\n"
fi
MSG_RUN+="\\n\\nPress OK to continue, or close this window to stop the program."

zenity --title=firejail-welcome.sh --info --ellipsize --text="$MSG_I_ROOT_REQUIRED"
$PROGRAM --title="$TITLE" --info --width=600 --height=40 --text="$MSG_RUN"
[[ $? -eq 1 ]] && exit 0

passwd=$(zenity --title=firejail-welcome.sh --password --cancel-label=OK)
if [[ -n "${sed_scripts[*]}" ]]; then
sudo -S -p "" -- sed -i "${sed_scripts[@]}" /etc/firejail/firejail.config <<<"$passwd" || { zenity --title=firejail-welcome.sh --error; exit 1; };
cp $SYSCONFDIR/firejail.config $SYSCONFDIR/firejail.config-
sed -i "${sed_scripts[@]}" $SYSCONFDIR/firejail.config
fi
if [[ "$run_firecfg" == "true" ]]; then
sudo -S -p "" -- firecfg <<<"$passwd" || { zenity --title=firejail-welcome.sh --error; exit 1; };
# return 55 to inform firecfg symlinks are desired
exit 55
fi
sudo -k
unset passwd

zenity --title=firejail-welcome.sh --info --icon-name=security-medium-symbolic --text="$MSG_I_FINISH"
#******************************************************
# all done
#******************************************************
exit 0
19 changes: 15 additions & 4 deletions src/firecfg/main.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@
#include "../include/firejail_user.h"
int arg_debug = 0;
char *arg_bindir = "/usr/local/bin";
int arg_guide = 0;

static char *usage_str =
"Firecfg is the desktop configuration utility for Firejail software. The utility\n"
Expand Down Expand Up @@ -375,8 +376,7 @@ int main(int argc, char **argv) {
return 0;
}
else if (strcmp(argv[i], "--guide") == 0) {
return system(LIBDIR "/firejail/firejail-welcome.sh");
return 0;
arg_guide = 1;
}
else if (strcmp(argv[i], "--list") == 0) {
list();
Expand Down Expand Up @@ -442,6 +442,19 @@ int main(int argc, char **argv) {
umask(orig_umask);
}

if (arg_guide) {
int status = system("sudo "LIBDIR "/firejail/firejail-welcome.sh zenity " SYSCONFDIR);
if (status == -1) {
fprintf(stderr, "Error: cannot run firejail-welcome.sh\n");
exit(1);
}

// the last 8 bits of the status is the return value of the command executed by system()
// firejail-welcome.sh returns 55 if setting sysmlinks is required
if (WEXITSTATUS(status) != 55)
return 0;
}

// clear all symlinks
clean();

Expand Down Expand Up @@ -473,8 +486,6 @@ int main(int argc, char **argv) {
#endif
}



// set new symlinks based on ~/.config/firejail directory
set_links_homedir(home);

Expand Down

0 comments on commit 62e33cf

Please sign in to comment.