Secure Firefox using native sandbox, Flatpak (Flathub/Fedora) | Discussion / Clarification

[chrisawi (Chris Williams)]

@boredsquirrel

Sandboxes

I heard that the native app sandbox of Firefox and Chromium would be better than bubblewrap, which is used by Flatpak.

I dont know how this would be, as the native version has rw access to my complete home folder. It may be less protected against system files, but I am curious if that is true.

Direct access to user namespaces isn’t available inside the flatpak sandbox because that would enable sandbox bypass, but flatpak does provide a portal API to create a more restrictive sub-sandbox. Chromium-based flatpaks use that via zypak (Chromium itself uses a patch from the same author).

The Firefox flatpak doesn’t use that API because it would cause excessive memory usage without some architectural changes. This isn’t as bad as it sounds because Firefox apparently doesn’t rely on namespacing for its sandbox; it’s rather defense in depth.

1756236 - Figure out how to chroot/use namespace isolation in flatpak

@boredsquirrel

SELinux

I only have a very rough understanding of SELinux. But I suppose, when configured very well, it gives great security.

Does every app need its own SELinux profile, or are there generic ones? I can’t imagine that every small Flatpak or even third party app has a SELinux profile.

Is Fedora Firefox better protected through SELinux than Flathub for example? Or mozillas binary in general, which the Flathub version executes inside the container?

To my knowledge, SELinux is not used for confining flatpak apps. Flatpak does ship a policy module, but it’s only for flatpak-system-helper. In general, Fedora’s SELinux policy mostly confines system services.

@boredsquirrel

Hardware access

A big reason not to use the Flatpak is hardware access, for Yubikey/Nitrokey etc. authenticators. But I think this should also be hardened, so that Firefox doesnt actually have all that access over all my drives?

Could someone elaborate what exactly Firefox can and can’t do, and if there are easy, non-breaking changes one could apply to give it less, but the needed permissions?

The Firefox flatpak currently has the devices=all permission. More portals are needed to cover the remaining use cases before that can be disabled by default. However, I don’t think any core functionality would break if you choose to override it.