mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-21 06:45:29 -06:00
594300374d
* rework chromium
+ 516d0811 has removed fundamental security features.
(remove caps.drop=all, nonewprivs, noroot, seccomp, protocol; add
caps.keep)
Though this is only necessary if running under a kernel which
disallow
unprivileged userns clones. Arch's linux-hardened and debian kernel
are
patched accordingly. Arch's linux and linux-lts kernels support this
restriction via sysctk (kernel.unprivileged_userns_clone=0) as users
opt-in.
Other kernels such as mainline or fedora/redhat always support
unprivileged
userns clone and have no sysctl parameter to disable it. Debian and
Arch
users can enable it with 'sysctl kernel.unprivileged_userns_clone=1'.
This commit adds a chromium-common-hardened.inc which can be included
in
chromium-common to enhance security of chromium-based programs.
+ chromium-common.profile: add private-cache
+ chromium-common.profile: add wruc and wusc, but disable it for the
following
profiles until tested. tests welcome.
- [ ] bnox, dnox, enox, inox, snox
- [ ] brave
- [ ] flashpeak-slimjet
- [ ] google-chrome, google-chrome-beta, google-chrome-unstable
- [ ] iridium
- [ ] min
- [ ] opera, opera-beta
+ move vivaldi-snapshot paths from vivaldi-snapshot.profile to vivaldi.
/usr/bin/vivaldi is a symlink to /etc/alternatives/vivaldi which can
be
vivaldi-stable, vivaldi-beta or vivaldi-snapshot.
vivaldi-snapshot.profile
missed also some features from vivaldi.profile, solve this by making
it
redirect to vivaldi.profile. TODO: exist new paths such as
.local/lib/vivaldi
also for vivaldi-snapshot?
+ create chromium-browser-privacy.profile (closes #3633)
* update 1
+ add missing 'ignore whitelist /usr/share/chromium'
+ revert 'Move drm-relaktions in vivaldi.profile behind
BROWSER_ALLOW_DRM.'. This breaks not just DRM, it break things such
as AAC too. In addition vivaldi shows a something is broken pop-up,
we would have a lot of 'does not work with firejail' issues.
* update 2
* update 3
fixes #3709
22 lines
636 B
Text
22 lines
636 B
Text
# Firejail profile for dnox
|
|
# This file is overwritten after every install/update
|
|
# Persistent local customizations
|
|
include dnox.local
|
|
# Persistent global definitions
|
|
include globals.local
|
|
|
|
# Disable for now, see https://github.com/netblue30/firejail/pull/3688#issuecomment-718711565
|
|
ignore whitelist /usr/share/chromium
|
|
ignore include whitelist-runuser-common.inc
|
|
ignore include whitelist-usr-share-common.inc
|
|
|
|
noblacklist ${HOME}/.cache/dnox
|
|
noblacklist ${HOME}/.config/dnox
|
|
|
|
mkdir ${HOME}/.cache/dnox
|
|
mkdir ${HOME}/.config/dnox
|
|
whitelist ${HOME}/.cache/dnox
|
|
whitelist ${HOME}/.config/dnox
|
|
|
|
# Redirect
|
|
include chromium-common.profile
|