Is there a way to disable Firefox filepicker in Linux?
Working on hardening a Linux Distro. The idea is to let users run only Firefox and just use it for browsing. All file system access (even browse) for the users should be restricted.
Managed to restrict file system access every possible manner. But Firefox's file picker is giving it away while accessing websites which ask to upload files or attachments (ex: email).
Looking for a way to disable filepicker or any other idea to overcome the situation.
OS: Ubuntu 16.04 LTS Firefox Version: 52
Thanks in advance for any ideas or suggestions.
Изменено srinu9
Все ответы (5)
Unless there is a userChrome.css that denies that options or the O/S itself will have to deny that access is the only other action that can be done. Also have you like in Windows tried make the user with restrictions so they are limited to actions they can do? And as long as sites permits or let's user attach files the browser can't block that action. That would be something the O/S has to block that actions. This is what I get from reading here.
Thank you WestEnd for the pointer towards userChrome.css. I was able to further research based on your comment and found [http://forums.mozillazine.org/viewtopic.php?f=7&t=218698].
Implemented the suggestion by "klades" in that thread and set ui.allow_platform_file_picker to false. While this solution doesn't completely block file picker, it hides everything in filepicker and renders it unusable. Goal achieved :-)
I do not think that ui.allow_platform_file_picker is still supported in current Firefox releases. The code for userChrome.css will probably still work like you noticed. Note that userChrome.css can be bypassed by starting in Safe Mode although on Linux this is more work (Windows: hold Shift; Mac: hold Options;). I don't know if you can run Firefox in a sandbox on Linux that blocks all access to content outside the sandbox.
Thank you for the response and heads up cor-el. Yes, looks like ui.allow_platform_file_picker is removed from the latest releases. I should find a better solution which can survive updates.
Noted on the Safe-Mode bypass. It is impossible for the users to get into safe-mode. We have disabled all the menu items that can lead to safe mode and access to terminal also has been disabled.
I will explore more on the sandboxing and see if it can help. For now, will stick the current solution until a a better one is found.
Изменено srinu9
There is a DisableSafeMode policy to disable Safe Mode on Windows and Mac, so on Linux you are out of luck with a policy.
There are some Safe Mode start buttons on various about: pages. The good news is that you can disable (block) some about pages (about:config, about:profiles, about:support) via policy rules, so you do not have to do much.
See: