Browsers as Flatpak vs Distro package (DEB/RPM)?

NoahRaketic

The problem with packaging a browser as a flatpak is that Linux browsers rely on mechanisms like user namespaces to be able to properly isolate webpages, which they can't use when packaged as a flatpak. If you care about security, you should prefer installing it as a native package.

Until flatpak has mechanisms for browsers to implement sandboxing like Android has, this will likely continue to be the case.

SELinux is certainly an option, but such policies are complex and it's easy to accidentally grant excessively permissive rules.

meowijuana

schklom I'll look into that, thank you. I did restart after for sure. I moved back to a debloated windows 10 enterprise LTSC for the mean time but I have a second PC to test this all on.

Jasper82

mrket It's possible to use bwrap directly (used internally by Flatpak) to sandbox a Chromium based browser without breaking process isolation, though it's hard to do and not enough information about this is available IMO. It will also depend on your distro's (kernel) user namespace configuration.

If this is possible (but complicated) what isn't it done by the official package maintainers?

mrket

Jasper82 If this is possible (but complicated) what isn't it done by the official package maintainers?

AFAIU Flatpak uses seccomp to restrict the usage of user namespaces inside the sandbox, this isn't something a package maintainer can change.

Jasper82

mrket AFAIU Flatpak uses seccomp to restrict the usage of user namespaces inside the sandbox, this isn't something a package maintainer can change.

I mean why didn't they provide some custom bublewrap?

mrket

Jasper82 I mean why didn't they provide some custom bublewrap?

This isn't an issue with bubblewrap, but an issue with their usage of seccomp.

TheGodfather

Eumenia Flatpak provides a sandbox, that some apps are not fit to work with it, is not Flatpak's fault

Of course it is Flatpak's fault. If Flatpak used a reliable way to identify apps, instead of .flatpak-info, they could offer a permission toggle to allow unprivileged namespaces without it being a trivial sandbox escape. They plan to change that, so we probably will see that in the future.

Eumenia

meowijuana proton VPN downloaded from their website with whatever instructions were there at the time. Same for both mint and zorin. My friend had the exact same issue so I figured it was just due to sandboxing, is it a problem with how this proton install works?

https://protonvpn.com/support/official-linux-vpn-ubuntu

If you downloaded it they way the link describes, then it definitely not a Flatpak but a deb package.
So why are you bringing this issue has a counter point to Flatpak?

meowijuana

Eumenia because the other programs that circumvented the VPN were flatpaks....

eyphzlm

its simple just use this on fedora why worry about selinux policies you don't need to write any selinux policy at all. when you use sandbox from selinux the app already runs in confined domain just one line that's it

first install these packages sudo dnf install policycoreutils-sandbox selinux-policy-sandbox

and then run this command

on wayland:
sandbox -Y -s firefox

on x11:
sandbox -X -s firefox.

its more secure than bwrap/flatpak.

Eumenia

meowijuana because the other programs that circumvented the VPN were flatpaks....

Ok.
But then its an error in the VPN killswitch and not in Flatpak.
Sandboxing and application has nothing to do with bypassing VPNs.

eyphzlm when you use sandbox from selinux the app already runs in confined domain just one line that's it

first install these packages sudo dnf install policycoreutils-sandbox selinux-policy-sandbox

and then run this command

on wayland:
sandbox -Y -s firefox

on x11:
sandbox -X -s firefox.

its more secure than bwrap/flatpak.

What permissions do applications have that are sandboxed this way?

meowijuana

Eumenia that seems even less likely, although I tried SecureBlue instead of something Ubuntu based and set up the rpm package and it worked fine, so for whatever reason I guess Ubuntu was the constant, if it was the kill switch and or proton causing it, it would've reproduced on secureblue, but since it only happened on Ubuntu builds not just for myself but a friend with his own PC as well, I'm not sure what other conclusion one could arrive at. Either way, problem solved, I convinced my friend to ditch zorin as well so I guess it was a win win in the end.

WAU3604

Michael2852 Is there anything other then Flatpak that provides an eassy to use sandbox for which you don't need a computer science degree?

Honestly I'm not sure anything on Linux currently that provides that out of the box without any configuration satisfactorily.

Though, I'm honestly fine if It requires some knowledge of computer science and in this vein I've been wondering about NixOS and GUIX whether they'd be better to Harden. Though still falling short due to Desktop security in general and the Linux Kernel.

meowijuana that seems even less likely, although I tried SecureBlue instead of something Ubuntu based and set up the rpm package and it worked fine

I'm curious how it worked out for you, as i installed Secureblue on my own laptop but it kept crashing when using it and eventually would no longer boot such that I just replaced it with CachyOS(something that I begrudgingly did).

Eumenia

meowijuana that seems even less likely, although I tried SecureBlue instead of something Ubuntu based and set up the rpm package and it worked fine, so for whatever reason I guess Ubuntu was the constant, if it was the kill switch and or proton causing it, it would've reproduced on secureblue, but since it only happened on Ubuntu builds not just for myself but a friend with his own PC as well, I'm not sure what other conclusion one could arrive at. Either way, problem solved, I convinced my friend to ditch zorin as well so I guess it was a win win in the end.

On explanation of this could be a rare bug in the Kernel that is patched in SecureBlue (which is based on Fedora, that ships a much newer Kernel then Ubuntu) but not patched in Ubuntu yet

meowijuana

WAU3604 that's unfortunate, it seems like we all have had some niche weird issues lol. Yeah secure blue just worked OOB for me, I tested it on a live USB first and messed around for a bit just to make sure everything seemed fine and then installed after I was happy with it, I hope you'll consider secureblue again, I think it's a good enough OS to hopefully work good the second time around.

meowijuana

Eumenia yeah that could be it, or maybe proton's rpm package is compiled better, who knows. All I know is Linux is quirky sometimes, but lovably so.

Elgoog

meowijuana

meowijuana Yeah secure blue just worked OOB for me, I tested it on a live USB....

How did you get a live USB? Last I looked, Fedora did not provide a live ISO.

meowijuana

Elgoog a non persistent install with Rufus on a USB, I guess live USB might not be exactly the right terminology for that.

vqrmbkog

Elgoog

fedora provides many live iso build you need to check the spins

« Previous Page