Firefox Sandboxing Guide

 

Contents

• Introduction
• Default Setup
• Sandbox description
• Private browser setup
• Work setup
• Network Setup
• X11 sandbox
• Tor Browser
• More…

 

Introduction

TLDR version

In August 2015, Mozilla was notified by security researcher Cody Crews that a malicious advertisement on a Russian news site was exploiting a vulnerability in Firefox’s PDF Viewer. The exploit payload searched for sensitive files on users’ local filesystem, and reportedly uploaded them to the attacker’s server.

Several such exploits are discovered every year, and by the time they are reported, they’ve been in the wild for a while. The attacker gains full access to the file system, and he can run any program installed on the computer. He can even start a remote shell and run the commands manually.

The three main attacks we target with Firejail are ransomware, privilege escalations, and local network attacks. This is a short description of the technologies we use to prevent them, and some of the most common Firefox sandbox setups. We start with the default setup, recommended for entertainment and casual browsing.

 

Default Setup

The easiest way to start the sandbox is to prefix the command with firejail:

$ firejail firefox --no-remote

 

Note: By default, a single Firefox process instance handles multiple browser windows. If you already have Firefox running, you would need to use -no-remote command line option, otherwise you end up with a new tab or a new window attached to the existing Firefox process.

You can also integrate Firejail with your desktop environment by running sudo firecfg as described on our Download page. Then, you just click the browser icon in your desktop environtment menus to start the program.

Another method is to configure a desktop launcher. This is a simple text file in Desktop directory with the following content:

$ cat ~/Desktop/firefox.desktop
[Desktop Entry]
Name=firefox
Icon=/opt/firefox/browser/chrome/icons/default/default48.png
Terminal=false
Type=Application
Exec=/usr/bin/firejail /opt/firefox/firefox -no-remote


 

In the example above I show a desktop launcher for a Firefox browser installed /opt directory.

 

Sandbox description

For privacy purposes we deploy a very restrictive Mandatory Access Control system. The sandbox allows Firefox to access only a small set of system files and directories. All private user information was removed from home directory. Please remember to save your downloaded files in Downloads, everything else will evaporate when you close the browser.

 

User home directory in Firefox browser.

 

Note: The same home directory layout is imposed by Firejail for all networked applications and games. For email we bring in email folders, for media players we add Videos, Music etc. Usually, Documents directory is highly restricted, only few applications have access to it.

Password files, encryption keys and development tools are also removed from the sandbox. If Firefox tries to access such a file, log messages are sent to syslog. Example:

 

Dec 3 11:43:25 debian firejail[70]: blacklist violation - sandbox 26370, exe firefox, syscall open64, path /etc/shadow
Dec 3 11:46:17 debian firejail[70]: blacklist violation - sandbox 26370, exe firefox, syscall opendir, path /boot

 

Privilege escalations are handled mainly by seccomp-bpf and nonewprivs. These are two Linux kernel technologies specifically designed for this purpose. A number of other kernel technologies are layered on top of them, such as capability sets, an user namespace without root user, and partitions and directories mounted using nosuid flag. If available, we also start AppArmor on top of everything. With all these kernel layers upon layers in place, it is hard to tell in a real scenario which layer triggered first and stopped the exploit.

Advanced Browser Security

In this video I describe a full hacking session from the perspective of the attacker. I simulate a remote shell into the browser, and try to get control of the system. I describe how the Mandatory Access Control system, seccomp-bpf, and a combination of network namespace and netfilter firewall are used to prevent further escalation.

 

Private browser setup

Use this setup to access your bank account, or any other site dealing with highly sensitive private information. The idea is you trust the site, but you don’t trust the addons and plugins installed in your browser. Use –private Firejail option to start with a factory default browser configuration, and an empty home directory.

Also, you would need to take care of your DNS setting – current home routers are ridiculously insecure, and the easiest attack is to reconfigure DNS, and redirect the traffic to a fake bank website. Use –dns Firejail option to specify a DNS configuration for your sandbox:

 

$ firejail --private --dns=1.1.1.1 --dns=9.9.9.9 firefox -no-remote

 

Work setup

Use this setup for remote office work, or when you have a number of programs employed for a specific purpose. Start by creating a new directory, let’s say /home/username/work, and segregate your applications in this directory. Pass this directory to –private when you start your apps:

$ firejail --private=/home/username/work thunderbird &
$ firejail --private=/home/username/work firefox -no-remote &

 

Both Mozilla Thunderbird and Firefox think ~/work is the user home. The configuration is preserved when the sandbox is closed.

 

Network Setup

Network attacks usually happen in enterprise settings. Failing a regular ransomware, and failing to rise privileges, the attacker tries to exploit servers running on the local network. Most likely the target was some very specific server on the local network to begin with.

Assuming eth0 is the main Ethernet interface, we create a new TCP/IP stack, and we connect it to the wired Ethernet interface. Then, we ARP-scan the network and pick up a random, unused IP address:

$ firejail --net=eth0 firefox

 

Network namespace configured in a Firejail sandbox

 

Note: Ubuntu runs a local DNS server in the host network namespace. The server is not visible inside the sandbox. Use --dns option to configure an external DNS server:

$ firejail --net=eth0 --dns=9.9.9.9 firefox

 

By default, if a network namespace is requested, Firejail installs a network filter customized for regular Internet browsing. It is a regular iptable filter, you can customize it, or you can bring in your own.

 

$ firejail --net=eth0 --netfilter=/etc/firejail/nolocal.net firefox

 

nolocal.net filter above allows only traffic from outside, all local traffic is dropped.

On top of that, you can add a hosts file implementing an adblocker:

 

$ firejail --net=eth0 --netfilter=/etc/firejail/nolocal.net \
--hosts-file=~/adblock firefox

 

There are several scenarios where you would want to use the networking feature:

• Anonymity on a local network – by default we assign random IP and MAC addresses to your sandbox. Once the sandbox is closed, the addresses disappear. You can run in parallel multiple applications, each one with a different IP address.
• You have an SSH server running on your computer – this could provide an opportunity for your attacker to try a dictionary attack.
• Install an iptables firewall for your browser – mostly applicable in enterprise settings, where you need to protect various assets on your local network.
• Dynamic firewall – at startup, Firejail looks at the traffic and builds a firewall specific for your application. You might want to use this for Tor and VPN setups.

 

X11 sandbox

Firejail replaces the regular X11 server with Xpra or Xephyr servers (apt-get install xpra xserver-xephyr on Debian/Ubuntu), preventing X11 keyboard loggers and screenshot utilities from accessing the main X11 server.

The command is as follows:

$ firejail --x11 --net=eth0 firefox

 

A network namespace initialized with –net is necessary in order to disable the abstract X11 socket. If for any reasons you cannot use a network namespace, the socket will still be visible inside the sandbox, and hackers can attach keylogger and screenshot programs to this socket.

 

Tor Browser

Advanced Tor Browser Security

Tor Browser is the ultimate tool for protecting privacy while browsing online. All Tor network traffic is encrypted, and it is virtually impossible to track the IP address back to its user.

These are our recommended steps to set up the browser in Firejail sandbox. The setup should work on all Linux distributions.

 

1. Download Tor Browser from https://torproject.org

2. Assuming the archive was downloaded in Downloads directory, extract the files:

$ cd ~
$ tar -xvf Downloads/tor-browser-linux64-X.Y.Z.tar.xz

 

3. Find the name of your Ethernet interface:

$ ip addr show

 

4. Create a desktop launcher in Desktop directory:

$ cat ~/Desktop/tor.desktop
[Desktop Entry]
Name=tor
Icon=/home/USERNAME/tor-browser_en-US/Browser/browser/chrome/icons/default/default128.png
Terminal=false
Type=Application
Exec=firejail --name=tor --private=~/tor-browser_en-US --net=INTERFACE ./start-tor-browser.desktop

 

Replace USERNAME with your user name, and INTERFACE with the name of your Ethernet interface you found in step 3.

5. Start the browser by clicking the tor icon on your desktop. This is the default setup, also available for older Firejail versions.

6. Optionally, lock down your network by adding –netlock on your exec line in the launcher. This will install a dynamic firewall that will allow only traffic to the Tor guard node. You’ll find more details in the video.

 

VPN

How To Build Your Own VPN

This is the simplest VPN setup ever: Linux workstation running Firefox browser under Firejail, and a virtual machine in the cloud running an SSH server.

By default all cloud VMs run an SSH server. The tunnel uses SOCKS5 feature of OpenSSH. This setup should work with any other network applications supporting SOCKS5 protocol.

It is one of the fastest VPN tunnels out there. Due to the large number of enterprise users using SSH in the cloud, you are very likely to go through a VPN blockade undetected. Fly under the radar and have fun!

 

More…

• Sakaki’s EFI Install Guide/Sandboxing the Firefox Browser with Firejail – probably the best X11 sandboxing guide out there!
• All About Tor – removing personally identifiable information, setup, network firewall, using Tor as a DNS proxy
• Firejail BitTorrent Sandboxing Guide – how to use a DNS over HTTPS proxy to stop DNS-based attacks for a browser/BitTorrent client setup
• A Survey of Public DNS over HTTPS Servers – how to choose a DoH service