What’s Next for Multi-Process Firefox

Re:What’s Next for Multi-Process Firefox by nextos on Tuesday August 02, 2016 @06:24PM (#12213902)

True. If running Firefox in Linux, I'd also recommend to use application sandboxing facilities provided by the kernel.

For example, with Firejail [1] (completely unrelated to Firefox) one can do firejail <application> to run a sandboxed instance. Firejail comes bundled with rules for many applications to limit the files they can view from each sandboxed container. In case of a security breach, that keeps data leaks under control. E.g., an attacker might be able to steal stuff from your Firefox instance, but not from your home directory.

[1] https://firejail.wordpress.com/

[ Parent | on HN ]

Re:What’s Next for Multi-Process Firefox by ryuuchin on Tuesday August 02, 2016 @10:18PM (#12215115)

I think you can do some things with chroots[1] that you otherwise couldn't although I could be wrong. My knowledge on Chrome's linux sandboxing (just for comparison) is kind of limited. I'm sure there are other protections such as seccomp which you can heavily restrict in renderer processes that you otherwise couldn't.

[1] With grsecurity they can become much more chroot-jail like. Chrome uses chroot's I believe so it's very beneficial there.

[ Parent | on HN ]