mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #2863] Tor Browser profile for Whonix / tb-updater #1786
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#1786
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @adrelanos on GitHub (Jul 18, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2863
TLDR:
Could you please provide a firejail profile for use with Tor Browser when using path
/home/user/.tb/tor-browseras installation folder?This would then work for all users of tb-updater (Debian, Qubes and Whonix users).
Long:
Whonix maintainer here.
In Whonix we are using a slightly different folder.
Full path to
start-tor-browser.desktopWorking:
Not working:
Can we avoid using
--private?Could we somehow use the full path to
/home/user/.tb/tor-browser/start-tor-browser.desktop? I would hope that using firejail can become a simple prepend firejail vs not prepend firejail. At the moment our startup wrapper /usr/bin/torbrowser (does various unrelated things) does in essence:Which is working.
Also previously running
cd ~/.tb/tor-browserdoes not help.Also same error:
start-tor-browser.desktopis special indeed.Might that be confusing firejail?
What does also work: (based on https://github.com/netblue30/firejail/issues/2429#issuecomment-465545751 thanks to @rusty-snake)
firejail --whitelist=$HOME/.tb/tor-browser --profile=/etc/firejail/start-tor-browser.profile $HOME/.tb/tor-browser/Browser/start-tor-browser --detach
What also works:
firejail --profile=/etc/firejail/start-tor-browser.profile $HOME/.tb/tor-browser/Browser/start-tor-browser
Why were we able to drop
--whitelist=$HOME/.tb/tor-browser?Is profile
/etc/firejail/start-tor-browser.profileonly covering /home/user/.tb/tor-browser/Browser/start-tor-browser or all subsequent execution (i.e. the forked Firefox)?@rusty-snake commented on GitHub (Jul 18, 2019):
@adrelanos
How is TB started in whonix?outdated
What about the following (to test it) (You need firejail 0.9.58 or higher):
$HOME/.config/firejail/start-tor-browser.desktop.local:Run:
firejail /home/user/.tb/tor-browser/start-tor-browser.desktopIf you see
Reading profile /etc/firejail/start-tor-browser.desktop.profilethenthe right profile is loaded.FYI: I use my own TBB profile https://github.com/rusty-snake/firejailed-tor-browser/blob/master/tor-browser.profile.
PS: I'm not sure if your questions are rhetorical, if you want/need an answer to all the questions, say so.
@rusty-snake commented on GitHub (Jul 18, 2019):
I played a little bit in whonix:
@adrelanos commented on GitHub (Jul 19, 2019):
Thank you very much for your reply!
Not rhetorical. It's a balance of my eagerness to know vs your valuable time, hence split into TLDR and long part.
Priority for me is having a profile shipped by default in firejail (so it makes its way into firejail-profiles Debian packages in next Debian release)
I am not requesting a profile for
/usr/bin/torbrowser, which is a wrapper shipped by the tb-starter package developed by Whonix (not The Tor Project). The most important thing here it does is starting Tor Browser. The rest shouldn't be security sensitive. Another reason why I did not request it is to avoid the added work required for it. (My request is supposed to be "small" while an/usr/bin/torbrowserprofile is "bigger".)Tor Browser (the real
${HOME}/.tb/tor-browser/Browser/start-tor-browser/ the forked firefox) should not inherit these extra permissions (whoami,basename,cat,tty,sleep,ps,pstree,touch,systemctl).My idea was to keep things simple, compartmentalized.
/usr/bin/torbrowsershould stay out of the way as much as possible. (That's always been tb-starter package goal independent of this.)That would be my preferred solution. (Ultimately translated to an /etc/firejail profile.)
Unfortunately still gives
Error: no suitable /home/user/.tb/tor-browser/start-tor-browser.desktop executable founderror.Debian buster based.
A manual
cd ~/.tb/tor-browserbeforehand also does not help.@adrelanos commented on GitHub (Jul 19, 2019):
working:
not working:
However
/home/user/.tb/tor-browser/start-tor-browser.desktopis preferred since that is the canonical way to start Tor Browser expected by upstream, The Tor Project. What/home/user/.tb/tor-browser/Browser/start-tor-browseror contents of/home/user/.tb/tor-browser/start-tor-browser.desktopmight change but/home/user/.tb/tor-browser/start-tor-browser.desktophas a higher likelihood of staying the canonical starter.@rusty-snake commented on GitHub (Jul 19, 2019):
@adrelanos working with firejail 0.9.60 and newer:
If I see right,
torbrowser(in whonix) call at some pointstart-tor-browser.desktop(with a bit more env-vars around, ...). Where should came firejail? intorbrowser(likefirejail $SOMETHING/start-tor-browser.desktop? or as symlink (firecfg)?@adrelanos commented on GitHub (Jul 19, 2019):
[1] Yes kinda but but currently actually
/home/user/.tb/tor-browser/Browser/start-tor-browserwhich is a bug, since not the canonical way to start Tor Browser.That is a good question.
Our wrapper
/usr/bin/torbrowsershouldn't cause work for other upstreams such as firejail. At least that was my original idea. Usually upstream are like "not our issue" understandably. Appreciate the thought.So from my compartmentalization perspective could we see this as a bug or feature request:
"firejail should be able to execute
.desktopfiles such asstart-tor-browser.desktop"?/usr/bin/torbrowsersupports configuration or environment variabletb_starter_bin_pre.tb_starter_bin_pre=firejail torbrowserwill currently result inOr in future when [1] is fixed (waiting to see how we deal with firejail here) would result in:
I was also considering to implement a command line parameter
torbrowser --firejail(or--hardening) (and configuration option) doing this for the user.Neither solution seems very standard conform. Should not be surprising though. The root cause of this is the absence of a deb package of Tor Browser.
What do you think is best here? Should this be done in firejail so firecfg creates a wrapper around /usr/bin/torbrowser should should /usr/bin/torbrowser keep care of invoking firejail?
Related: I am also considering to combine firejail with apparmor and hardened malloc. Related: https://github.com/netblue30/firejail/issues/2689 Mentioning this here since that consideration might change the best way forward.
@rusty-snake commented on GitHub (Jul 19, 2019):
Doesn't look like firejail related.
possibilities
torbrowser+ firecfgContra:
torbrowserfor now:
when it has firejail >= 0.9.60
@rusty-snake commented on GitHub (Jul 19, 2019):
I would prefer 2. + adding
${HOME}/.tb/tor-browser(or${HOME}/.tb) to https://github.com/netblue30/firejail/blob/master/etc/start-tor-browser.desktop.profile@adrelanos commented on GitHub (Jul 19, 2019):
@rusty-snake commented on GitHub (Jul 19, 2019):
FYI:
Reason: firejail automatically loads
start-tor-browser.desktop.profilewhich is awhitelisting profileIn general: yes
Reason:
torbrowser-launcher.profileis awhitelisting profile.If you want to debug such situations, you need to be in firejail:
firejail --ignore=private-bin --profile=torbrowser-launcher bashReason: tor-browser-en-us.profile is just an alias for torbrowser-launcher
Reason: start-tor-browser.profile does not
whitelistin $HOME@adrelanos commented on GitHub (Jul 20, 2019):
Actually, there might also be a middle ground which we can call 3.
Still have to think if there is any security issue with that.
/usr/bin/torbrowser would call /usr/lib/tb-starter/tb-starter-wrapper and the latter would be much easier to confine. It would not need these extra permissions (
whoami,basename,cat,tty,sleep,ps,pstree,touch,systemctl).Would 3. would solve all the contra of 2.?
@rusty-snake commented on GitHub (Jul 20, 2019):
You mean that /usr/bin/torbrowser call
fierjail /usr/lib/tb-starter/tb-starter-wrapper?Where
tb-starter-wrapper.profileThat should work.
@adrelanos commented on GitHub (Jul 20, 2019):
Not sure
Maybe just call
/usr/lib/tb-starter/tb-starter-wrapperwithout firejail.In this case could firecfg take responsibility for prepending firejail as it is done for other applications too?
@rusty-snake commented on GitHub (Jul 20, 2019):
Calling
tb-starter-wrapper(no absolut path) with placingtb-starter-wrapperin/usr/bin(or symlinking/usr/bin/tb-starter-wrapperto/usr/lib/tb-starter-wrapper) would work with firecfg.Or adding
/usr/lib/tb-starter/into $PATH. 😄 not realy suggesting that@adrelanos commented on GitHub (Jul 20, 2019):
/usr/bin/tb-starter-wrappercould also be in/usr/binindeed./usr/bin/tb-starter-wrapper:Then we could make firecfg work.
@rusty-snake commented on GitHub (Jul 22, 2019):
How do you want it to be?
/usr/bin/tb-starter-wrapper+tb-starter-wrapper.profileor
firejail --profile=start-tor-browser.desktop --x11=xorg --quiet TOR-BROWSER+noblacklist ${HOME}/.tb,whitelist ${HOME}/.tb/tor-browserinstart-tor-browser.desktop.profile+blacklist ${HOME}/.tbindisable-programs.inc@adrelanos commented on GitHub (Jul 22, 2019):
rusty-snake:
This looks better long term.
@rusty-snake commented on GitHub (Jul 22, 2019):
tb-starter-wrapper.profile:
+ adaptations in
firecfg.config&disable-programs.inc@adrelanos commented on GitHub (Jul 25, 2019):
tb-starter-wrapper.profile looks good. Will test soon.
Should we ship that profile? Probably won't matter either way unless there would be some syntax change which we'd miss. But I guess we have to re-check this at every Debiain release (buster -> bullseye) upgrade anyhow.
Wouldn't know.
@rusty-snake commented on GitHub (Jul 26, 2019):
I would add it into firejail.
Only adding
tb-starter-wrappertofirecfg.configso firecfg creates symlinksand adding
blacklist ${HOME}/.tbtodisable-programs.incso other firejailed programms can't access ${HOME}/.tb@adrelanos commented on GitHub (Jul 27, 2019):
Sounds great! Please proceed.
@rusty-snake commented on GitHub (Jul 28, 2019):
@adrelanos
50fc318db4@adrelanos commented on GitHub (Jul 29, 2019):
Looks perfect, thanks so much!
@adrelanos commented on GitHub (Aug 14, 2019):
Trying to emulate your change.
(Cannot find src/firecfg/firecfg.config on Debian buster with similar contents.)
Did I emulate the symlink correctly?
Do you know why it does not work?
@rusty-snake commented on GitHub (Aug 18, 2019):
Uhh I forgot to update
private-bin.This is the path in the git repo, on your system it should be /usr/lib64/firecfg/firecfg.config or simelary (Don't know for debian).