搜尋 Mozilla 技術支援網站

防止技術支援詐騙。我們絕對不會要求您撥打電話或發送簡訊,或是提供個人資訊。請用「回報濫用」功能回報可疑的行為。

了解更多

Help with Security Features Warning for Linux

  • 2 回覆
  • 2 有這個問題
  • 19 次檢視
  • 最近回覆由 azeu92

more options

DO NOT COPY AND PASTE! This is not written correctly! Someone please help with this or correct the code. I tried different ways to do this and nothing works ---- I am beyond frustrated with it.


Security features warning

You may see a warning that “some of Firefox’s security features may offer less protection on your current operating system”.

The sandbox in Firefox makes use of unprivileged user namespaces when creating new processes for enforcing more security. This can be considered a security risk, therefore some Linux distributions have started to restrict its usage and only allow it to work where there is an AppArmor profile.

Such profiles can only cover a limited set of installations paths, including Snap and Debian packages. They cannot however cover some other use cases, such as tarball installations as well as local development builds.

To create an AppArmor profile for Firefox:

In /etc/apparmor.d/, create a file with the name firefox-local

In the file, add the following:

  1. This profile allows everything and only exists to give the
  2. application a name instead of having the label "unconfined"

abi <abi/4.0>, include <tunables/global> profile firefox-local /home/<USER>/bin/firefox/{firefox,firefox-bin,updater} flags=(unconfined) {

   userns,
   # Site-specific additions and overrides. See local/README for details.
   include if exists <local/firefox>

}


Replace <USER> with your Linux user name. This assumes the Firefox install is at $HOME/bin/

Once you have saved the file, run sudo systemctl restart apparmor.service in the Linux terminal.

DO NOT COPY AND PASTE! This is not written correctly! Someone please help with this or correct the code. I tried different ways to do this and nothing works ---- I am beyond frustrated with it. Security features warning You may see a warning that “some of Firefox’s security features may offer less protection on your current operating system”. The sandbox in Firefox makes use of unprivileged user namespaces when creating new processes for enforcing more security. This can be considered a security risk, therefore some Linux distributions have started to restrict its usage and only allow it to work where there is an AppArmor profile. Such profiles can only cover a limited set of installations paths, including Snap and Debian packages. They cannot however cover some other use cases, such as tarball installations as well as local development builds. To create an AppArmor profile for Firefox: In /etc/apparmor.d/, create a file with the name firefox-local In the file, add the following: # This profile allows everything and only exists to give the # application a name instead of having the label "unconfined" abi <abi/4.0>, include <tunables/global> profile firefox-local /home/<USER>/bin/firefox/{firefox,firefox-bin,updater} flags=(unconfined) { userns, # Site-specific additions and overrides. See local/README for details. include if exists <local/firefox> } Replace <USER> with your Linux user name. This assumes the Firefox install is at $HOME/bin/ Once you have saved the file, run sudo systemctl restart apparmor.service in the Linux terminal.

由 NoahSUMO 於 修改

所有回覆 (2)

more options

Hi

I was involved in this support article. What seems to be the problem, how can we help?

有幫助嗎?

more options

Paul,

1) Operating system- 6.11.0-25-generic #25~24.04.1-Ubuntu SMP PREEMPT_DYNAMIC Tue Apr 15 17:20:50 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

Installed Firefox-Nighly in /opt/firefox, and created a symlink to the Firefox executable-

ln -s /opt/firefox/firefox /usr/local/bin/firefox

In the folder /etc/apparmor.d/, created a file with the name firefox-local with the following parameters:

abi <abi/4.0>, include <tunables/global> profile firefox-local /opt/firefox/{firefox,firefox-bin,updater} flags=(unconfined) {

  userns,
  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/firefox>

}

2) Ran sudo systemctl restart apparmor.service. Also rebooted the system

3) Followed by sudo apparmor_status which presents:

15 processes are unconfined but have a profile defined.

  /opt/firefox/firefox-bin (69492) firefox
  /opt/firefox/crashhelper (69498) firefox
  /opt/firefox/firefox-bin (69558) firefox
  /opt/firefox/firefox-bin (69584) firefox
  /opt/firefox/firefox-bin (69606) firefox
  /opt/firefox/firefox-bin (69659) firefox
  /opt/firefox/firefox-bin (69744) firefox
  /opt/firefox/firefox-bin (69755) firefox
  /opt/firefox/firefox-bin (70104) firefox
  /opt/firefox/firefox-bin (71639) firefox
  /opt/firefox/firefox-bin (72498) firefox
  /opt/firefox/firefox-bin (72544) firefox
  /opt/firefox/firefox-bin (72677) firefox
  /opt/firefox/firefox-bin (72750) firefox
  /opt/firefox/firefox-bin (73108) firefox


What have I done incorrectly?

有幫助嗎?

問個問題

如果您還沒有帳號,您必須先登入帳號 來回覆文章。還沒有帳號的話,只能發問新問題