-
Notifications
You must be signed in to change notification settings - Fork 71
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Enable ptrace protection for browser sandbox
Only allow ptrace from a parent process to its children or via CAP_SYS_PTRACE. To verify sandbox status for Brave, Chrome, Firefox see brave://sandbox, chrome://sandbox, about:support, respectively. Also describe disadvantages of enabling unprivileged user namespaces. Distributions like Debian currently disable unprivileged user namespaces by default to decrease the kernel attack surface for local privilege escalation. See Debian bug #898446. If kept disabled, Brave 1.2+ and Chrome will still enforce namespace sandboxing via their setuid-root helper executable. See brave/brave-browser#3420 and brave/brave-browser#6247. Firefox does not include a setuid-root binary, however, so unprivileged user namespaces are useful to have for defence-in-depth, but not critical. See <https://www.morbo.org/2018/05/linux-sandboxing-improvements-in_10.html>.
- Loading branch information
Showing
5 changed files
with
26 additions
and
11 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,22 @@ | ||
class ocf::browser_sandbox { | ||
# Change kernel settings for the sandbox used by Brave, Chrome, and Firefox. | ||
# Verify sandbox status at brave://sandbox, chrome://sandbox, about:support, | ||
# respectively. | ||
sysctl { | ||
# Distributions like Debian currently disable unprivileged user namespaces | ||
# by default to decrease the kernel attack surface for local privilege | ||
# escalation. See Debian bug #898446. If kept disabled, Brave 1.2+ and | ||
# Chrome will still enforce namespace sandboxing via their setuid-root | ||
# helper executable. See brave/brave-browser#3420 and | ||
# brave/brave-browser#6247. Firefox does not include a setuid-root binary, | ||
# however, so unprivileged user namespaces are useful to have for | ||
# defense in depth, but not critical. See | ||
# <https://www.morbo.org/2018/05/linux-sandboxing-improvements-in_10.html>. | ||
'kernel.unprivileged_userns_clone': | ||
value => '1'; | ||
# Enable ptrace protection. Only allow ptrace from a parent process to its | ||
# children or via CAP_SYS_PTRACE. | ||
'kernel.yama.ptrace_scope': | ||
value => '1'; | ||
} | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.