Firefox 129 wants new AppArmor config or should Firejail do that?

[Gerenuk]

Firefox 129 now issues a security warning and it is suggested to create a basic AppArmor profile as described in https://support.mozilla.org/kb/install-firefox-linux?as=u#w_security-features-warning

Should I just do this and will it interact with Firejail? Or do I have to configure this somewhere else (how?) if I use Firejail for Firefox?

[glitsj16]

We are aware of this. But there's a problem. The suggested AppArmor profile uses abi <abi/4.0>, which isn't available yet on several distributions (like Arch Linux and derivatives, Ubuntu 22.04,...). Firejail's AppArmor support itself depends on abi <abi/3.0>, and we'd need to port it to the 4.* ABI as soon as that is stable.

Context:

• see notes for AA 4.x releases
• see AA wiki abi <abi/4.0> references on unprivileged userns restrictions

TL;DR nothing actionable yet.
Best thing you can do for now is to disable the warning:
user_pref("security.sandbox.warn_unprivileged_namespaces", false);

HTH

[Gerenuk]

Thx!
Do I have security implications for Firefox now? (as I'll just wait)
Eventually, there will be a Firejail update? Will I have to do some manually steps after that or will it all be handled by the Firejail update automatically? I mean do I have to edit configurations or install other package updates, once Firejail is ported?
The Firejail update will also update this AppArmor/Abi?

[rusty-snake]

Do I have security implications for Firefox now?

Yes, you should make sure firefox has all necessary permissions for internal sandboxing to work.
Possible options are:

• Replace firejail with a strict(er) AppArmor profile for firefox
• Use firejail with an AppArmor profile for firejail (i.e. not firejail-default)
• Disable unprivileged_userns_restrictions
  • https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_userns_restriction#permanently-disabling-the-restriction
  • The way Ubuntu 24.04 implemented thoses restrictions caused quite a bit of breakage for no good because it can easily be bypassed AFAIK.

Eventually, there will be a Firejail update? Will I have to do some manually steps after that or will it all be handled by the Firejail update automatically?

When the time reaches it will be handled automatically. Whether it is the next firejail release (after ~1.5 years) or a future is open.

[Gerenuk]

Oh, interesting.

So, Firejail still does it's job with Firefox, but some Firefox AppArmor feature (sandboxing?) is currently not enabled with that?
Is the ABI version the same as the AppArmor version? I somehow need that 4.0 version (of AppArmor) and would Firejail still work if I install that?

What would be the easiest way for a beginner (with some will to research) to enable Firefox use that AppArmor feature, but also restrict access to system files as Firejail does. I can copy config files, but I don't really understand the details.

Would your first option also allow me to limit file system access and can I copy some files (which?) from Firejail for that? Not sure I understand the second option. And the third option is not the most secure?

Could you outline how I could achieve that? (link to references to read, filenames to create, files to copy from firejail, ...)
Creating my own AppArmor profile for Firefox would currently be the easiest option and it could do the same as Firejail does currently?

Don't worry if some questions are too complex to explain to a beginner.

[glitsj16]

If you really need AppArmor 4.x, it might be possible on Ubuntu 23.10 and up (because those offer the required version). You'll need to do some digging to get familiar with AppArmor if you don't, but Ubuntu and Arch Linux wiki's cover that in depth.

Here's a rundown on how to proceed:

• ensure you have the apparmor-profiles package installed
• there are two firefox related AA profiles under /usr/share/apparmor/extra-profiles
• follow the README in that path to enable them by placing those under /etc/apparmor.d/ (and note these are not turned on by default because they are not as mature as the profiles in /etc/apparmor.d/...
• after you have done all the above, you can use the referenced
  https://support.mozilla.org/kb/install-firefox-linux?as=u#w_security-features-warning to create that firefox-local AA profile
• reboot to ensure the new AA files are properly loaded/cached

On the firejail side you need to point the firefox profile to the special AA profile:

$ cat ~/.config/firejail/firefox-common.local
# not sure which AA profile will work best, so you might have to try both
# start with the more generic one
apparmor /usr/bin/firefox
#apparmor /usr/bin/firefox.sh
ignore apparmor
name firefoxy

Probably easier to run Firefox from terminal to observe its output:

firejail --name=test /usr/bin/firefox

While FF is running, you can check the AA status of its sandbox:

firejail --apparmor.print=test

Interesting experiment, good luck!

[stormtheory]

So I had this problem until I added --noprofile to the my firejail command after defining my own profile as can seen here: https://github.com/stormtheory/firefox-firejail-wrapper/blob/main/firefox.profile not sure why that works but I now do not get the warning as long as I put --noprofile. So my command line if not rand with my wrapper would be firejail --name=sandyfox --noroot --disable-mnt --novideo --noprofile --machine-id --include=/sandbox/firefox.profile /sandbox/firefox-bash.

[rusty-snake]

firejail --name=sandyfox --noroot --disable-mnt --novideo --noprofile --machine-id --include=/sandbox/firefox.profile /sandbox/firefox-bash

You're calling it wrong. If /sandbox/firefox.profile is supposed to be used as a profile, use --profile instead of --include. Otherwise things will become strange.

--noprofile makes it work because some causing command is no off.

[stormtheory]

Cool just changed it, and tested it. firejail --name=sandyfox --noroot --disable-mnt --novideo --machine-id --profile=/sandbox/firefox.profile /sandbox/firefox-bash and well no warning. I tested it again to make sure the warning will appear. I confirmed firefox can still make the warning. So with my command line, (above) works with no warning. Thank you @rusty-snake for heads up! Using Mint 21.3, by the way and uses abi <abi/3.0>.