Update Librewolf profile and Add Sway profile #4164

vnepogodin · 2021-04-04T18:33:00Z

Parent is shutting down then including firefox-common-addons.profile
error.log

Not working then including firefox-common-addons.profile

rusty-snake

LGTM, some suggestions below.

Should we make sway redirect to i3?

etc/profile-a-l/librewolf.profile

etc/profile-a-l/sway.profile

ghost · 2021-04-04T21:43:12Z

LGTM, some suggestions below.

Should we make sway redirect to i3?

Sway is almost i3 the .config are also same the main diif is wayland and x11 but why need to redirect to i3. I think sway profile will also be cool. if not working then we can redirect to i3 for sure 👍

rusty-snake · 2021-04-04T21:51:14Z

Sway is almost i3

That's the reason.

glitsj16 · 2021-04-04T21:55:37Z

@rusty-snake I agree it would make sense to implement sway as a redirect profile. Perhaps the term 'redirect' caused confusion in this context for other posters.

Sway is almost i3 the .config are also same the main diif is wayland and x11 but why need to redirect to i3. I think sway profile will also be cool. if not working then we can redirect to i3 for sure

@BL4CKH47H4CK3R I think there's some confusion here. The 'redirect' relates to how we use one main profile for common options that are shared among several applications. It does not impact the way sway will work, it only affects the way we write firejail profiles to avoid doing the same stuff all over again.

ghost

@glitsj16, I know that desktop environment or windows manager doesn't matter when I am using firejail. But I see people are creating profile like for i3 which is redundant so I told. Even archiso is enough to run firejail 😄

etc/profile-a-l/librewolf.profile

so.. `No its not needed as it reveals lots of important /usr/share folders like /usr/share/fonts which can used for font fingerprinting and OS detection. Like the site or attacker will know that which font you are using. Linux and windows common font are not same so its a problem. Besides there are so many other important folders as I see. Librewolf can launch and work perfectly without this options`

rusty-snake

Re-add include whitelist-usr-share-common.inc.

vnepogodin · 2021-04-05T08:38:54Z

Re-add include whitelist-usr-share-common.inc.

Why ?

rusty-snake · 2021-04-05T08:58:18Z

TL;DR: It whitelist lots of important /usr/share folders.
Always use include {allow,whitelist}-common.inc in PRs.

The role of {allow,whitelist}-common.inc is to make maintaining profiles easier and cause less breakage. Always use them in PRs unless you can 100% guarantee that they are not required. The paths to some resources can differ between distros, others depend on the HW where it runs or the configuration. Or the version you run. Have you tested that it works on every major distro, with any configuration, any DE, any HW? It's not enough that it can start there. Can it play audio? Is HTTPS working? What about spellchecking? Just the first line (whitelist /usr/share/alsa) can you guarantee that not whitelisting /usr/share/alase does not break sound? With raw alsa?

vnepogodin · 2021-04-05T09:08:02Z

TL;DR: It whitelist lots of important /usr/share folders.

Always use include {allow,whitelist}-common.inc in PRs.

The role of {allow,whitelist}-common.inc is to make maintaining profiles easier and cause less breakage. Always use them in PRs unless you can 100% guarantee that they are not required. The paths to some resources can differ between distros, others depend on the HW where it runs or the configuration. Or the version you run. Have you tested that it works on every major distro, with any configuration, any DE, any HW? It's not enough that it can start there. Can it play audio? Is HTTPS working? What about spellchecking? Just the first line (whitelist /usr/share/alsa) can you guarantee that not whitelisting /usr/share/alase does not break sound? With raw alsa?

I agree but how about ?

#4164 (comment)

rusty-snake · 2021-04-05T09:26:01Z

(Privacy is out of the scope of firejail, it's for security).

its not needed as it reveals lots of important /usr/share folders

It's not needed because it reveals important folders???!

like /usr/share/fonts which can used for font fingerprinting

This does not prevent font fingerprinting. Actually it makes the situation worse. If you whitelist /usr/share/fonts and don't install to much other fonts you have the same font FP as any other user of your distro. If you omit it and put on a gas mask you're even more unique.

and OS detection

Your OS can be detected anyway.

Linux has an other TCP/IP-Stack then Window => Passive detection possible.
Some math operations on floating point number has other results on Linux then Window. => Active detection via JavaScript
Your scrollbar-width depends on your GTK-Theme and version => Active detection via JS or CSS possible.
Your HTTP-UA contains your OS.
Your JS-UA contains your OS, even with RFP.
...

Linux and windows common font are not same so its a problem.

Masking your fonts still does not make them the same.

Librewolf can launch

yes

work perfectly without this options

no (I'm 90% sure it can not open HTTPS on some system without wusc)

rusty-snake · 2021-04-05T09:28:03Z

BTW I don't think whitelist /usr/share/gnome-shell/search-providers/firefox-search-provider.ini (firefox-search-provider) is used.

Revert `include whitelist-usr-share-common.inc` Sync with Firefox profile

rusty-snake · 2021-04-06T14:02:40Z

etc/profile-a-l/librewolf.profile

-# librewolf requires a shell to launch on Arch. We can possibly remove sh though.
-#private-bin bash,dbus-launch,dbus-send,env,librewolf,python*,sh,which
+# librewolf requires a shell to launch on Arch.
+#private-bin bash,dbus-launch,dbus-send,env,librewolf,sh,which


Based on https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=librewolf#n325 it's just private-bin librewolf,sh if anyone want to test ...

etc/profile-a-l/librewolf.profile

solved

rusty-snake · 2021-04-06T14:06:06Z

This PR has a a merge conflict, please rebase.

rusty-snake · 2021-04-14T18:11:40Z

etc/profile-a-l/librewolf.profile

 # librewolf requires a shell to launch on Arch. We can possibly remove sh though.
+# Add the next line to your librewolf.local to enable private-bin.
 #private-bin bash,dbus-launch,dbus-send,env,librewolf,python*,sh,which


Suggested change

#private-bin bash,dbus-launch,dbus-send,env,librewolf,python*,sh,which

#private-bin bash,dbus-launch,dbus-send,env,librewolf,sh,which

I've had added before but it can't merge changes
1d8c94c

btw tested

After a rebase (unlike a merge of master) it should work w/o conflicting. Rebasing and squashing some of the commits makes sense anyway if you look at the history. So if you can do an interactive rebase.

Not working then including firefox-common-addons.profile

so.. `No its not needed as it reveals lots of important /usr/share folders like /usr/share/fonts which can used for font fingerprinting and OS detection. Like the site or attacker will know that which font you are using. Linux and windows common font are not same so its a problem. Besides there are so many other important folders as I see. Librewolf can launch and work perfectly without this options`

etc/profile-a-l/librewolf.profile

Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>

rusty-snake · 2021-04-19T20:04:20Z

merged, thanks!

vnepogodin added 2 commits April 4, 2021 22:09

Add Sway profile

3d9f936

Fix issue

97f0eca

Not working then including firefox-common-addons.profile

vnepogodin changed the title ~~Crash Librewolf~~ Crash Librewolf and Add Sway profile Apr 4, 2021

rusty-snake reviewed Apr 4, 2021

View reviewed changes

etc/profile-a-l/librewolf.profile Show resolved Hide resolved

etc/profile-a-l/sway.profile Show resolved Hide resolved

Allow sway's fallback config

1e8e390

ghost reviewed Apr 4, 2021

View reviewed changes

etc/profile-a-l/librewolf.profile Show resolved Hide resolved

vnepogodin changed the title ~~Crash Librewolf and Add Sway profile~~ Update Librewolf profile and Add Sway profile Apr 4, 2021

rusty-snake previously requested changes Apr 5, 2021

View reviewed changes

vnepogodin added 2 commits April 6, 2021 00:47

well..

2bd2fc1

Revert `include whitelist-usr-share-common.inc` Sync with Firefox profile

😄 What just hapened

6afe467

rusty-snake reviewed Apr 6, 2021

View reviewed changes

vnepogodin added 5 commits April 6, 2021 23:00

🔄 Sync with upstream

f2c8d74

Merge tested from PR

7799b69

🔄 Sync with upstream

abf26d1

Merge tested from PR

1d8c94c

Revert changes

6ac9bb5

rusty-snake mentioned this pull request Apr 14, 2021

Profile requests #1139

Open

rusty-snake approved these changes Apr 14, 2021

View reviewed changes

Add Sway profile

b578b79

vnepogodin added 11 commits April 18, 2021 19:55

Fix issue

5e8a7e7

Not working then including firefox-common-addons.profile

Allow sway's fallback config

6d975f1

🔄 Rebase

25e0946

😄 What just hapened

c11f21a

Merge tested from PR

5aedd49

🔄 Sync with upstream

d5a29c2

Merge tested from PR

e9111f2

Revert changes

737c1bd

Merge remote-tracking branch 'origin/vnepogodin/master'

2e0eac4

Update

3ae7a2e

rusty-snake reviewed Apr 18, 2021

View reviewed changes

etc/profile-a-l/librewolf.profile Outdated Show resolved Hide resolved

glitsj16 approved these changes Apr 18, 2021

View reviewed changes

Update librewolf.profile

807fea8

Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>

rusty-snake approved these changes Apr 19, 2021

View reviewed changes

rusty-snake merged commit 98ed471 into netblue30:master Apr 19, 2021

matu3ba mentioned this pull request Oct 7, 2021

luarocks matu3ba/firejail#1

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update Librewolf profile and Add Sway profile #4164

Update Librewolf profile and Add Sway profile #4164

vnepogodin commented Apr 4, 2021

rusty-snake left a comment

ghost commented Apr 4, 2021

rusty-snake commented Apr 4, 2021

glitsj16 commented Apr 4, 2021 •

edited

Loading

ghost left a comment

rusty-snake left a comment

vnepogodin commented Apr 5, 2021

rusty-snake commented Apr 5, 2021

vnepogodin commented Apr 5, 2021

rusty-snake commented Apr 5, 2021

rusty-snake commented Apr 5, 2021

rusty-snake Apr 6, 2021

rusty-snake commented Apr 6, 2021

rusty-snake Apr 14, 2021

vnepogodin Apr 18, 2021 •

edited

Loading

rusty-snake Apr 18, 2021

vnepogodin Apr 18, 2021

rusty-snake commented Apr 19, 2021

	#private-bin bash,dbus-launch,dbus-send,env,librewolf,python*,sh,which
	#private-bin bash,dbus-launch,dbus-send,env,librewolf,sh,which

Update Librewolf profile and Add Sway profile #4164

Update Librewolf profile and Add Sway profile #4164

Conversation

vnepogodin commented Apr 4, 2021

rusty-snake left a comment

Choose a reason for hiding this comment

ghost commented Apr 4, 2021

rusty-snake commented Apr 4, 2021

glitsj16 commented Apr 4, 2021 • edited Loading

ghost left a comment

Choose a reason for hiding this comment

rusty-snake left a comment

Choose a reason for hiding this comment

vnepogodin commented Apr 5, 2021

rusty-snake commented Apr 5, 2021

vnepogodin commented Apr 5, 2021

rusty-snake commented Apr 5, 2021

rusty-snake commented Apr 5, 2021

rusty-snake Apr 6, 2021

Choose a reason for hiding this comment

rusty-snake commented Apr 6, 2021

rusty-snake Apr 14, 2021

Choose a reason for hiding this comment

vnepogodin Apr 18, 2021 • edited Loading

Choose a reason for hiding this comment

rusty-snake Apr 18, 2021

Choose a reason for hiding this comment

vnepogodin Apr 18, 2021

Choose a reason for hiding this comment

rusty-snake commented Apr 19, 2021

glitsj16 commented Apr 4, 2021 •

edited

Loading

vnepogodin Apr 18, 2021 •

edited

Loading