Project

General

Profile

Feature #5802

Harden the web browser at compile time

Added by Tails over 6 years ago. Updated about 5 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
-
Category:
-
Target version:
Start date:
Due date:
% Done:

100%

Feature Branch:
Type of work:
Research
Blueprint:
Starter:
No
Affected tool:
Browser

Description

Rationale

Given our current release schedule, there's one week in six when Tails users are vulnerable to a bunch of known security issues in Iceweasel.

Roadmap

  1. Find out what additional hardening compilation option can possibly be added to Iceweasel by the Debian maintainer. The Debian security team might be happy to help. Here's what the maintainer's already stated opinions on the topic (Debian bug #609975 and Debian bug #653191): I'm really not a big fan of -Wl,-z,relro and -Wl,-z,now. For instance, I'm not sure -z relro buys anything worth, while it may have a significant startup performance impact on big applications. (and if I'm not mistaken, -z relro actually makes things not work with selinux, seeing how selinux already breaks the mprotect that removes the write bit on code sections after text relocations). Moritz has doubts about the relro part, and Support for selinux in Debian is marginal at best, anyway. Last discussion about this was started on Debian bug #759165.
  2. Design a great plan.
  3. Implement a great plan.
  4. See what the maintainer is happy to take.
  5. If still needed, add more hardening compilation options to our own Iceweasel builds.

How others do

Hardening compilation options currently enabled in:

Related to...

  • Once we have AppArmor support in Tails (#5370), we'll probably want to use it as an additional way to contain the least powerful exploits a bit more.
  • Incremental upgrades may help putting out a minor Tails release a bit faster after a Firefox ESR release.

Related issues

Related to Tails - Feature #7953: Migrate to (something closer to) the Tor Browser Resolved 09/24/2014
Related to Tails - Feature #7155: Build the browser with Address Sanitizer or SoftBound Rejected 05/02/2014

History

#1 Updated by intrigeri about 6 years ago

  • Subject changed from harden Iceweasel at compile time to Harden Iceweasel at compile time
  • Starter set to No

#2 Updated by BitingBird over 5 years ago

  • Category set to 176

#3 Updated by intrigeri over 5 years ago

  • Description updated (diff)

#4 Updated by intrigeri over 5 years ago

  • Description updated (diff)

#5 Updated by intrigeri over 5 years ago

  • Description updated (diff)

#6 Updated by intrigeri over 5 years ago

  • Description updated (diff)

#7 Updated by intrigeri about 5 years ago

  • Description updated (diff)

#8 Updated by intrigeri about 5 years ago

  • Related to Feature #7953: Migrate to (something closer to) the Tor Browser added

#9 Updated by intrigeri about 5 years ago

  • Description updated (diff)

Once we complete the migration to the TBB, we'll get some more hardening (PIE, relro).

#10 Updated by intrigeri about 5 years ago

  • Subject changed from Harden Iceweasel at compile time to Harden the web browser at compile time

#11 Updated by intrigeri about 5 years ago

  • Description updated (diff)

#12 Updated by intrigeri about 5 years ago

  • Description updated (diff)

#13 Updated by intrigeri about 5 years ago

  • Related to Feature #7155: Build the browser with Address Sanitizer or SoftBound added

#14 Updated by intrigeri about 5 years ago

  • Status changed from Confirmed to Fix committed
  • Target version changed from Hardening_M1 to Tails_1.2
  • % Done changed from 0 to 100

The migration to TBB gives us all that for free. Next step is #7155.

#15 Updated by anonym about 5 years ago

  • Status changed from Fix committed to Resolved

Also available in: Atom PDF