Firefox 57, set to be released tomorrow, will ship with improvements to the browser's sandbox security feature for Linux users.
The Firefox sandboxing feature isolates the browser from the operating system in a way to prevent web attacks from using a vulnerability in the browser engine and its legitimate functions to attack the underlying operating system, place malware on the filesystem, or steal local files.
Chrome has always run inside a sandbox. Initially, Firefox ran only a few plugins inside a sandbox — such as Flash, DRM, and other multimedia encoding plugins.
In 2016, Firefox received support for running in multiple processes. Mozilla engineers split the browser UI process from the web page rendering operations.
The latter received a sandbox, which Mozilla improved with every release. Because Windows and Linux are different operating systems and most of the Firefox userbase is on Windows, Mozilla focused on improving the Firefox sandbox for Windows first.
In Firefox 57, the Firefox sandbox feature will receive improvements to put it on similar levels of protections as the Windows version.
Because Firefox is still intertwined with the GTK user interface, the Firefox web rendering process is still allowed to read from the filesystem in various situations.
"Rather than postpone the security improvements till this is reworked, we've elected to work around this by allowing a few very specific locations through," Pascutto said.
"Due to the infinite configurability of Linux systems, it's always possible there will be cases where a non-standard setup can break things, and we've kept Firefox configurable, so you can at least help yourself, if you're so inclined," the developer added.
The Firefox team has added new parameters to the Firefox about:config configuration panel that Linux users can tweak in case some web pages don't display as they did before the user updated to Firefox 57.
This parameter allows users to disable the sandbox when set to 0. When enabled, this parameter has three values — 1, 2, and 3 — detailed in the table below.
|Job Level||What's Blocked by the Sandbox?|
This parameter allows users to add new directory paths that Firefox is allowed to read data from. Users should be careful when adding new folders to this list. They should make sure the directory only contains libraries that Firefox needs and not personal data that malware or attackers can scan and steal.
Similar to the above, only this parameter allows users to decide to what folders can Firefox write data.
This parameter allows users to whitelist what previously blocked system calls can Firefox make.