browser integration with sandboxing enabled

[D0nnieD4rk0]

recently started playing around with firejail and im wondering what files/binaries are required to be whitelisted for the browser extension to see the client

[droidmonkey]

You need to allow the browser to start the proxy application and connect to the local socket. Socket location can be found at

keepassxc/src/browser/BrowserShared.cpp

Line 34 in 089c8df

return path.isEmpty() ? QStandardPaths::writableLocation(QStandardPaths::TempLocation) + serverName

Your best bet is to strace your browser and look for failures.

[rusty-snake]

All you need to do: https://github.com/netblue30/firejail/blob/0.9.66/etc/profile-a-l/firefox.profile#L27-L30

See netblue30/firejail#3952 and netblue30/firejail#4279 for more information.

[droidmonkey]

Couldn't you just noblacklist the keepassxc socket files and blacklist the {RUNUSER} directory? Then everything would be blocked except the keepassxc files without explicitly whitelisting them (which I gather requires them to exist). I am not a firejail expert, just reading the docs.

There is also the option to mkfile similar to mkdir, not sure if that helps either.

There must be a way to handle files that are not present at startup.

[rusty-snake]

Couldn't you just noblacklist the keepassxc socket files and blacklist the {RUNUSER} directory?

The following does not work:

noblacklist ${RUNUSER}/org.keepassxc.KeePassXC.BrowserServer
blacklist ${RUNUSER}

What would work:

noblacklist ${RUNUSER}/bus
noblacklist ${RUNUSER}/dconf
noblacklist ${RUNUSER}/gdm/Xauthority
noblacklist ${RUNUSER}/ICEauthority
noblacklist ${RUNUSER}/.mutter-Xwaylandauth.*
noblacklist ${RUNUSER}/pulse/native
noblacklist ${RUNUSER}/wayland-0
noblacklist ${RUNUSER}/wayland-1
noblacklist ${RUNUSER}/xauth_*
noblacklist ${RUNUSER}/[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]
noblacklist ${RUNUSER}/org.keepassxc.KeePassXC.BrowserServer
blacklist ${RUNUSER}/*

However this is still less secure than whitelisting because anything created after the startup will still appear.

There is also the option to mkfile similar to mkdir, not sure if that helps either.

For regular files which are open/read+write/close mkfile is fine but for a sockets I don't think that it works (though I am not 100% sure edit: tested, mkfile does not work with sockets).

There must be a way to handle files that are not present at startup.

If you mean that you belief there is a way: no, at least for firejail everything is done at startup.

If you mean that this should be implemented:

• For blacklist this is racey.
• For whitelist this could be done using inotify. However with the current development speed (for new feature) this will take years, therefore I asked here if there is a chance this will be done. (From a external point of view this looks like a small change to KeePassXC (compared to a bigger change in firejail)). Furthermore a change in firejail would not help users of other sandboxing programs (whether they are recommended or not is a separate question).

[droidmonkey]

It is a small change for us but I wanted to understand the limitations and semantics of firejail for future reference.

[rusty-snake]

FWIW I've hacked this my way.

firefox.local

mkdir ${RUNUSER}/keepassxc
whitelist ${RUNUSER}/keepassxc
# Only if private-bin is enabled for firefox
private-bin keepassxc-proxy,keepassxc-proxy-wrapper

keepassxc.local

# Only if whitelisting is enabled for keepassxc
mkdir ${HOME}/.mozilla/native-messaging-hosts
mkfile ${HOME}/.mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json
whitelist ${HOME}/.mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json
# Does not work with GNOME XWayland.
# In this form only for keepassxc --platform wayland and UID 1000.
mkdir /run/user/1000/keepassxc
whitelist /run/user/1000/keepassxc
env XDG_RUNTIME_DIR=/run/user/1000/keepassxc
env WAYLAND_DISPLAY=/run/user/1000/wayland-0
#env DBUS_SESSION_BUS_ADDRESS is set by dbus-user filter

keepassxc.ini

[Browser]
CustomProxyLocation=/usr/local/bin/keepassxc-proxy-wrapper
Enabled=true
UseCustomProxy=true

/usr/local/bin/keepassxc-proxy-wrapper

#!/bin/bash
export XDG_RUNTIME_DIR=/run/user/1000/keepassxc
exec /usr/bin/keepassxc-proxy

[droidmonkey]

That seems legit!