starred/nix-config-ryan4yin
1
0 Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-11-13 12:13:36 +01:00
Code Issues Packages Projects Releases 10 Wiki Activity

docs(nixpak): document intentional Firefox media limits

Browse Source
This commit is contained in:
Ryan Yin committed 2026-11-01 10:49:52 +08:00
1 parent 3e6d89b3c4
commit d54b49b799
3 files changed
+24 -14
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

SECURITY.md
+4 -1
View File
@@ -338,7 +338,10 @@ isolation. Source review and socket metadata—not reads of private credentials
Zoom's 7.2.1 client receives only `/dev/video0` and `/dev/video1` because it captures the webcam
directly via V4L2; no other app gets raw camera nodes and no raw PipeWire access is added.
Chromium-family browsers use only the app-scoped Secret portal for v12 cookie encryption; no
browser receives broad GNOME Keyring authority. Firefox uses its own NSS storage.
browser receives broad GNOME Keyring authority. Firefox uses its own NSS storage. Firefox camera
and remote screen sharing are intentionally disabled: Firefox does not support the XDG
Camera/ScreenCast portal path used by this policy, and enabling those features would require
granting raw video-device or direct PipeWire access. We deliberately keep that privilege closed.
- **Rollout note (WA-045):** v12 is verified on a disposable profile, but if the portal is
unavailable Chromium may fall back to weaker v10 storage; portal initialization is monitored.
- Policy/build passes for all nine wrappers. Interactive validation passed for Firefox, Chrome,
hardening/README.md
+5 -1
View File
@@ -21,7 +21,7 @@ explicitly; other files use the document portal. Every app also has private writ
| App | Network | Writable paths | Grants |
| ------------ | ------------- | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- |
| Firefox | Host loopback | `~/.mozilla`, personal files, Trash, Firefox artwork | Media, browserpass, MPRIS, idle |
| Firefox | Host loopback | `~/.mozilla`, personal files, Trash, Firefox artwork | Audio, browserpass, MPRIS, idle; camera/screen sharing intentionally unavailable |
| Chromium | Host loopback | `~/.config/chromium`, personal files | Media, browserpass, MPRIS, idle, v12 Secret |
| Chrome | Isolated | `~/.config/google-chrome`, Downloads | Media, browserpass, MPRIS, idle, v12 Secret |
| Brave Origin | Isolated | `~/.config/BraveSoftware/Brave-Origin`, Downloads | v12 Secret |
@@ -56,6 +56,10 @@ All browsers get read-only NSS certificates, printing, native notifications and
- pasta isolates loopback, not LAN access. Chromecast discovery is unverified.
- Brave Origin and Edge intentionally have no PulseAudio, Camera, ScreenCast or MPRIS grants. They
are backup browsers, not media browsers.
- Firefox camera and remote screen sharing are intentionally disabled. Firefox does not support the
XDG Camera/ScreenCast portal path used here, so granting camera or screen-capture access would
require widening the sandbox with raw `/dev/video*` or direct PipeWire access. We choose not to
grant that privilege.
## Validation
hardening/tests/runtime-validation.md
+15 -12
View File
@@ -12,18 +12,18 @@ Nixpak wrappers are accepted in three layers:
## Current status
| App | Policy/build | Runtime |
| ---------------------- | ------------ | ----------------------------------------------------- |
| Firefox | Pass | Interactive pass |
| Chromium | Pass | Automated smoke + interactive pass |
| Chrome | Pass | Interactive pass |
| Brave Origin | Pass | Interactive pass; backup browser without media grants |
| Edge | Pass | Interactive pass; backup browser without media grants |
| Zoom | Pass | Interactive pass |
| QQ / Telegram | Pass | Interactive startup/tray pass |
| WeChat (native nixpak) | Pass | Interactive Wayland validation pending |
| Foliate | Pass | Interactive validation pending |
| Krita | Pass | Interactive validation pending |
| App | Policy/build | Runtime |
| ---------------------- | ------------ | ----------------------------------------------------------------- |
| Firefox | Pass | Interactive pass; camera/remote sharing intentionally unavailable |
| Chromium | Pass | Automated smoke + interactive pass |
| Chrome | Pass | Interactive pass |
| Brave Origin | Pass | Interactive pass; backup browser without media grants |
| Edge | Pass | Interactive pass; backup browser without media grants |
| Zoom | Pass | Interactive pass |
| QQ / Telegram | Pass | Interactive startup/tray pass |
| WeChat (native nixpak) | Pass | Interactive Wayland validation pending |
| Foliate | Pass | Interactive validation pending |
| Krita | Pass | Interactive validation pending |
Intentional exceptions:
@@ -31,6 +31,9 @@ Intentional exceptions:
exception. Chrome, Brave Origin and Edge use pasta-isolated loopback.
- **Brave Origin and Edge are backup browsers.** They intentionally have no PulseAudio, Camera,
ScreenCast or MPRIS grants.
- **Firefox camera and remote screen sharing are intentionally disabled.** Firefox does not support
the XDG Camera/ScreenCast portal path used here, so enabling them would require granting raw video
devices or the direct PipeWire socket. We deliberately do not grant those privileges.
## Browser smoke test