Why don't browsers use sandbox on FreeBSD?

P

Pwkepkw

Firefox gives a message right after the installation, saying that some of the components are not available because they had needed backends. One of them is the sandbox.
Although it doesn't give any message, chromium or iridium doesn't have any sandbox too. chrome:sandbox gives me a blank page.

I'm bit afraid to use a browser that doesn't have a sandbox. Do anybody have the same problem too?

Screenshot from 2019-07-28 02-25-52.png
 
There is little FreeBSD developers can do about that. The orgs that made the browsers need to get their developers to add it into their respective browsers.

A number of them have done so though. Capsicum is a sandbox, if I am correct, and a number of apps now have it integrated into them. The FreeBSD team is also continuously working to get some services run on it.
 
Last edited by a moderator:
Lamia said:
There is little FreeBSD developers can do about that. The orgs that made the browsers need to get their developers to add it into their respective browsers.

A number of them have done so though. Capsicum is a sandbox, if I am correct, and a number of apps now have it integrated into them. The FreeBSD team is also continuously working to get some services run on it.
Click to expand...

So, people who use freebsd as their daily OS, they really use unsandboxed browsers? Isn't it a big security issue?
 
Last edited by a moderator:
Pwkepkw said:
So, people who use freebsd as their daily OS, they really use unsandboxed browsers? Isn't it a big security issue?
Click to expand...

I use FreeBSD as my daily OS and don't consider it an issue. I use the HTTPS Everywhere, NoScript, Privacy Badger, Toggle Referrer, uBlock Origin and User-Agent Switcher extensions for Firefox, run my browser from the usr account only and am not the least bit worried.
 
FWIW, Chrome (and chromium) put each tab in its own, separate process, so this is one level of sandboxing. Furthermore it's probably a good idea to run your browser inside a jail (probably with a different, non-privileged user ID). It's not perfect because it can still access your X server (this will be better with Wayland), but it should be sufficient for most purposes.
 
unitrunker said:
I'm curious what it would take to get X running in a jail.
Click to expand...
It is not too much work (if by that you mean running an X application in a jail -- here is the HowTo I wrote sometime ago) but as said by olli@ you still have to use X forwarding which reduces a lot the isolation provided by jails. I have been playing with x11/xpra lately in order to get ride of this X forwarding (IIRC, x11/xpra is used by the Subgraph Linux distribution for this very purpose). I still have to find a way to play videos smoothly though.
 
This seems like a feature for the window manager. Anything launched from a window manager menu is automatically placed in a jail (or capsicumized or chroot'd). You have *really* isolated desktop environments.

X and Wayland both rely on shared memory to push pixmaps across processes. Otherwise, the pixmaps must be pushed over the wire which is much slower. That may be impacting your videos.
 
unitrunker said:
This seems like a feature for the window manager.
Click to expand...
Reading further, they use a launcher called Oz and use x11/xpra with Unix Domain Socket (may be a hint since I did not try yet using socket) for X applications.

unitrunker said:
X and Wayland both rely on shared memory to push pixmaps across processes. Otherwise, the pixmaps must be pushed over the wire which is much slower. That may be impacting your videos.
Click to expand...
As a simple user, my knowledge on the subject is not deep enough to even understand your sentence. But at least, I know where to look and read.
 
Wozzeck.Live said:
I use Windows since more than 40 years.....
Click to expand...
Do you mean Microsoft Windows? The first version was released in 1985, so that would be 34 years at most.
I never got any viruses, I have never been hacked in any manner
Click to expand...
Let's say you never noticed you've been hacked. You'll never know for sure.

On several occasions I had to fix Windows PCs that had “undefined problems”. Turned out they were hacked and/or malware-infected, without their owner being aware of it. Typically the complaint was that “the internet is slow” or “the HDD lights up all the time”. They had no idea that their PC was sending 10,000 spam mails per minute.
The main things : never run a browser in root mode
Click to expand...
More importantly: Don't even log into your machine (or into the X server) as root. Even better, change the root account to have /usr/sbin/nologin as its login shell.
And I personally recommend you to switch to Firefox.
Click to expand...
Well, it's purely a matter of taste which browser you use. Personally I dislike Firefox. I use Chromium (Chrome) for most things. For simple web pages that don't require JavaScript I use Dillo, because it is much, much faster than the other browsers, and more secure because it doesn't support JavaScript at all (but unlike lynx or w3m it is a graphical browser that supports CSS with images, tables etc.).
 
Pwkepkw, what do you expect to see below the given link, namely chrome://sandbox?

I got the most recent versions of chrome 76.0.3809.87 on Mac (German localization) and Windows (Portuguese localization), and I see only:

Mac
Chrom Sandbox Mac.png

Windows
Chrom Sandbox Windows.png

So what?
 
Why don't browsers use sandbox on FreeBSD?
Click to expand...

The actual intellectually honest answer: some things are written against Linux-specific interfaces and it takes time and effort to port (or rewrite) them. There are no other reasons.

Wozzeck.Live said:
The main things : never run a browser in root mode
Click to expand...

Protecting root isn't all that important when all your valuable information is stored under your regular user account.
 
shkhln said:
The actual intellectually honest answer
Click to expand...
The actual answer is that NO browser runs sandboxed unless you, the user, sandbox it. As already stated, browsers sandbox their tabs within the browser. The original question assumes all other operating systems sandbox the browser. The reality is, as I already said, NO operating system does this!
 
I'm talking about unimplemented features in general, but if you want to pick an internet fight around the definition of the word "sandbox", you sure can.

drhowarddrfine said:
The actual answer is that NO browser runs sandboxed unless you, the user, sandbox it.
Click to expand...
Am I supposed to implement this myself?

drhowarddrfine said:
As already stated, browsers sandbox their tabs within the browser.
Click to expand...
Firefox explicitly doesn't do this. There is a limited pool of content processes.

drhowarddrfine said:
The original question assumes all other operating systems sandbox the browser.
Click to expand...
Nope. The original question talks about pkg info -D firefox message. Go read it.

drhowarddrfine said:
The reality is, as I already said, NO operating system does this!
Click to expand...
Ok.
 
Pwkepkw said:
Although it doesn't give any message, chromium or iridium doesn't have any sandbox too. chrome:sandbox gives me a blank page.
Click to expand...
The page is blank because unlike other platforms, neither of those browsers is officially supported on FreeBSD, they are ports. On supported platforms (like Linux), they use platform specific extensions like network and PID namespaces (which if I'm not mistaken were created by Google), seccomp-bpf, SELinux, etc.
 
Wozzeck.Live said:
I use Windows since more than 40 years.....
Click to expand...
Windows 1.0 came out 32 years ago. (November 20, 1985) Although the first smoothly working version was 3.1 which came out in 1992. (27 years ago)

But yeah, those early versions are kinda fun nowadays. I especially like 3.0 on a TTL monitor - very cool. :)
 
You must log in or register to reply here.
Back
Top