github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #3513] docs: Improve U2F documentation #2210

New issue

Open

opened 2026-05-05 08:53:47 -06:00 by gitea-mirror · 6 comments

gitea-mirror commented

2026-05-05 08:53:47 -06:00

Owner

Originally created by @reinerh on GitHub (Jul 16, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3513

On the Debian bugtracker someone reported problems with enabling U2F, which is disabled by default.
The setting in firejail.config is a bit confusing, as it is named browser-disable-u2f, which is enabled by default (which means that u2f is disabled).
The manpages are only documenting the command line flag --nou2f and nou2f / BROWSER_DISABLE_U2F for profiles.
But from the documentation alone it's not possible to figure out, why U2F might be disabled. One needs to look into the configuration for that (and not get confused).

He also suggests to enable U2F (for browsers) by default. Opinions on that?

Originally created by @reinerh on GitHub (Jul 16, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3513 On the [Debian bugtracker](https://bugs.debian.org/965097) someone reported problems with enabling U2F, which is disabled by default. The setting in firejail.config is a bit confusing, as it is named `browser-disable-u2f`, which is **enabled** by default (which means that u2f is **disabled**). The manpages are only documenting the command line flag `--nou2f` and `nou2f` / `BROWSER_DISABLE_U2F` for profiles. But from the documentation alone it's not possible to figure out, why U2F might be disabled. One needs to look into the configuration for that (and not get confused). He also suggests to enable U2F (for browsers) by default. Opinions on that?

gitea-mirror added the

enhancement

documentation

labels 2026-05-05 08:53:47 -06:00

gitea-mirror commented

2026-05-05 08:53:49 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jul 16, 2020):

He also suggests to enable U2F (for browsers) by default. Opinions on that?

This would mean full /dev access for browsers (except the devices blacklisted by no*).

ce462b6b1f/etc/profile-a-l/firefox-common.profile (L52)

32c3669115
https://github.com/netblue30/firejail/issues/3170

@rusty-snake commented on GitHub (Jul 16, 2020): > He also suggests to enable U2F (for browsers) by default. Opinions on that? This would mean full /dev access for browsers (except the devices blacklisted by no*). https://github.com/netblue30/firejail/blob/ce462b6b1fbfe497df7f045844b2bb5a74e5c777/etc/profile-a-l/firefox-common.profile#L52 https://github.com/netblue30/firejail/commit/32c3669115a7168e5a7fa13347bd6f8daf838be0 https://github.com/netblue30/firejail/issues/3170

gitea-mirror commented

2026-05-05 08:53:50 -06:00

Author

Owner

@reinerh commented on GitHub (Jul 16, 2020):

This would mean full /dev access for browsers (except the devices blacklisted by no*).

Thanks, I wasn't aware that this would grant so wide access to /dev.

@reinerh commented on GitHub (Jul 16, 2020): > This would mean full /dev access for browsers (except the devices blacklisted by no*). Thanks, I wasn't aware that this would grant so wide access to /dev.

gitea-mirror commented

2026-05-05 08:53:51 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Jul 16, 2020):

iirc the private-dev is disabled only to allow u2f dongles be connected at will
you can remove that conditional for more security, but you then have to have your dongle connected before launching the browser/sandbox
I personally prefer the latter, but too many issues were filed that u2f wasn't working.

@SkewedZeppelin commented on GitHub (Jul 16, 2020): iirc the private-dev is disabled only to allow u2f dongles be connected at will you can remove that conditional for more security, but you then have to have your dongle connected before launching the browser/sandbox I personally prefer the latter, but too many issues were filed that u2f wasn't working.

gitea-mirror commented

2026-05-05 08:53:52 -06:00

Author

Owner

@smitsohu commented on GitHub (Jul 16, 2020):

Thanks, I wasn't aware that this would grant so wide access to /dev

My impression is that in its current form BROWSER_DISABLE_U2F is a bit of a misnomer

@smitsohu commented on GitHub (Jul 16, 2020): > Thanks, I wasn't aware that this would grant so wide access to /dev My impression is that in its current form `BROWSER_DISABLE_U2F` is a bit of a misnomer

gitea-mirror commented

2026-05-05 08:53:52 -06:00

Author

Owner

@ghost commented on GitHub (Jul 16, 2020):

My impression is that in its current form BROWSER_DISABLE_U2F is a bit of a misnomer

Indeed. I have seen users on the archlinux IRC channel asking questions about it. Maybe something like BROWSER_SUPPORT_U2F would be less confusing...

@ghost commented on GitHub (Jul 16, 2020): > My impression is that in its current form `BROWSER_DISABLE_U2F` is a bit of a misnomer Indeed. I have seen users on the archlinux IRC channel asking questions about it. Maybe something like `BROWSER_SUPPORT_U2F` would be less confusing...

gitea-mirror commented

2026-05-05 08:53:53 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jan 4, 2021):

For the record: https://github.com/netblue30/firejail/blob/master/contrib/firejail-welcome.sh

@rusty-snake commented on GitHub (Jan 4, 2021): For the record: https://github.com/netblue30/firejail/blob/master/contrib/firejail-welcome.sh

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2210

No description provided.

Rows
Columns