firefox: Arch Linux specific customizations (seccomp/userns)

[Neo00001]

firejail/etc/profile-a-l/firefox.profile

Line 26 in 86daaa9

#private-bin bash,dbus-launch,dbus-send,env,firefox,sh,which

private-bin firefox,sh is enough. Is there any reason to have rest of them?

firejail/etc/profile-a-l/firefox-common.profile

Line 47 in 86daaa9

seccomp !chroot

seccomp
seccomp.block-secondary

works on Arch iff unprivileged_userns_clone is disabled. I have tested on Arch KDE, can't say about other de though. but it should work. Should we put a small note for arch in firefox-common.profile?

[rusty-snake]

private-bin firefox,sh is enough. Is there any reason to have rest of them?

I have no Arch here, but if /usr/bin/firefox just looks like

#!/bin/sh
MOZ_FOO=bar
/usr/lib/mozilla/firefox

and /usr/lib/mozilla/firefox no shell-script, it should be ok. (If /usr/bin/firefox contains any debugging suff, ignore it we don't support firefox -debug out-of-the-box).

TL;DR: If /usr/bin/firefox does not use a program in the list it's very unlikely that it's used at all.

seccomp.block-secondary

Should work for nearly all programs except wine and steam. #3417

seccomp works on Arch if unprivileged_userns_clone is disabled

#2506

[glitsj16]

seccomp works on Arch if unprivileged_userns_clone is disabled

I've just stumbled onto another interesting Firefox env var in FF 86.0.1 (not sure if it existed before in prior versions): MOZ_ASSUME_USER_NS. What I added in #2506 still goes. But by adding env MOZ_ASSUME_USER_NS=0 to my firefox-common.local dropping security.sandbox.content.level to '3' is not needed to use firejail's full seccomp filter. Note this is without disabling unprivileged_userns_clone system-wide on Arch Linux.

So should we put a new profile for seccomp like chromium-hardened or should we put a note in firefox-common profile.

I'll need to do some more testing obviously (besides re-reading https://wiki.mozilla.org/Security/Sandbox#Content_Levels), but IMO this is a rather promising way to harden FF, regardless of having unprivileged_userns_clone or not. Does the best of both worlds exist after all? 👯‍♂️

[Neo00001]

env MOZ_ASSUME_USER_NS=0

this environmental variable works on fedora (gnome) also. btw,tracelog also works without breaking firefox on both Arch & Fedora. At least for me it didn't break.If possible test tracelog also.

[rusty-snake]

not sure if it existed before in prior versions

It's there since https://hg.mozilla.org/mozilla-central/rev/65391f2d6659bc82076bdbfaa6e8e6ad0dccde08 (2015).

env MOZ_ASSUME_USER_NS=0

Note that this disables any namespace based sandboxing in firefox.

[glitsj16]

env MOZ_ASSUME_USER_NS=0

Note that this disables any namespace based sandboxing in firefox.

That's indeed something to bare in mind. I find it rather complex to weigh pro's and cons against each other in this context. Is it more secure to use Firefox's internal sandboxing (fully) or does firejail's full seccomp filter provides the more secure alternative? If I look at the argumentation relating to chromium in #4087, I'm tempted to go with the latter, so firejail seccomp > FF internal sandboxing. If anyone has more info / additional opinions on this topic, that would be very welcome.

[Neo00001]

Is it more secure to use Firefox's internal sandboxing

You may test firefox with firejail --env=MOZ_SANDBOX_LOGGING=1 firefox to see whether you find anything useful.

env MOZ_ASSUME_USER_NS=0 - this disables unprivileged user namespaces & user namespaces for privileged processes still remains enabled.On the other hand,it seems unprivileged user namespaces is optional for firefox sandboxing (according to their wiki).You may still argue that it will weaken firefox's sandboxing but keep in mind that history of unprivileged_userns_clone is not that glossy security wise. My vote will be for disabling it.