From d54b49b7993ae6079749e8bf376ed8e4b765d6e0 Mon Sep 17 00:00:00 2001 From: Ryan Yin Date: Sun, 1 Nov 2026 10:43:31 +0800 Subject: [PATCH] docs(nixpak): document intentional Firefox media limits --- SECURITY.md | 5 ++++- hardening/README.md | 6 +++++- hardening/tests/runtime-validation.md | 27 +++++++++++++++------------ 3 files changed, 24 insertions(+), 14 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 3f19803c..c51147c1 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -338,7 +338,10 @@ isolation. Source review and socket metadata—not reads of private credentials Zoom's 7.2.1 client receives only `/dev/video0` and `/dev/video1` because it captures the webcam directly via V4L2; no other app gets raw camera nodes and no raw PipeWire access is added. Chromium-family browsers use only the app-scoped Secret portal for v12 cookie encryption; no - browser receives broad GNOME Keyring authority. Firefox uses its own NSS storage. + browser receives broad GNOME Keyring authority. Firefox uses its own NSS storage. Firefox camera + and remote screen sharing are intentionally disabled: Firefox does not support the XDG + Camera/ScreenCast portal path used by this policy, and enabling those features would require + granting raw video-device or direct PipeWire access. We deliberately keep that privilege closed. - **Rollout note (WA-045):** v12 is verified on a disposable profile, but if the portal is unavailable Chromium may fall back to weaker v10 storage; portal initialization is monitored. - Policy/build passes for all nine wrappers. Interactive validation passed for Firefox, Chrome, diff --git a/hardening/README.md b/hardening/README.md index 3090704e..007ca587 100644 --- a/hardening/README.md +++ b/hardening/README.md @@ -21,7 +21,7 @@ explicitly; other files use the document portal. Every app also has private writ | App | Network | Writable paths | Grants | | ------------ | ------------- | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- | -| Firefox | Host loopback | `~/.mozilla`, personal files, Trash, Firefox artwork | Media, browserpass, MPRIS, idle | +| Firefox | Host loopback | `~/.mozilla`, personal files, Trash, Firefox artwork | Audio, browserpass, MPRIS, idle; camera/screen sharing intentionally unavailable | | Chromium | Host loopback | `~/.config/chromium`, personal files | Media, browserpass, MPRIS, idle, v12 Secret | | Chrome | Isolated | `~/.config/google-chrome`, Downloads | Media, browserpass, MPRIS, idle, v12 Secret | | Brave Origin | Isolated | `~/.config/BraveSoftware/Brave-Origin`, Downloads | v12 Secret | @@ -56,6 +56,10 @@ All browsers get read-only NSS certificates, printing, native notifications and - pasta isolates loopback, not LAN access. Chromecast discovery is unverified. - Brave Origin and Edge intentionally have no PulseAudio, Camera, ScreenCast or MPRIS grants. They are backup browsers, not media browsers. +- Firefox camera and remote screen sharing are intentionally disabled. Firefox does not support the + XDG Camera/ScreenCast portal path used here, so granting camera or screen-capture access would + require widening the sandbox with raw `/dev/video*` or direct PipeWire access. We choose not to + grant that privilege. ## Validation diff --git a/hardening/tests/runtime-validation.md b/hardening/tests/runtime-validation.md index 6dc07fbd..8d8a5e5c 100644 --- a/hardening/tests/runtime-validation.md +++ b/hardening/tests/runtime-validation.md @@ -12,18 +12,18 @@ Nixpak wrappers are accepted in three layers: ## Current status -| App | Policy/build | Runtime | -| ---------------------- | ------------ | ----------------------------------------------------- | -| Firefox | Pass | Interactive pass | -| Chromium | Pass | Automated smoke + interactive pass | -| Chrome | Pass | Interactive pass | -| Brave Origin | Pass | Interactive pass; backup browser without media grants | -| Edge | Pass | Interactive pass; backup browser without media grants | -| Zoom | Pass | Interactive pass | -| QQ / Telegram | Pass | Interactive startup/tray pass | -| WeChat (native nixpak) | Pass | Interactive Wayland validation pending | -| Foliate | Pass | Interactive validation pending | -| Krita | Pass | Interactive validation pending | +| App | Policy/build | Runtime | +| ---------------------- | ------------ | ----------------------------------------------------------------- | +| Firefox | Pass | Interactive pass; camera/remote sharing intentionally unavailable | +| Chromium | Pass | Automated smoke + interactive pass | +| Chrome | Pass | Interactive pass | +| Brave Origin | Pass | Interactive pass; backup browser without media grants | +| Edge | Pass | Interactive pass; backup browser without media grants | +| Zoom | Pass | Interactive pass | +| QQ / Telegram | Pass | Interactive startup/tray pass | +| WeChat (native nixpak) | Pass | Interactive Wayland validation pending | +| Foliate | Pass | Interactive validation pending | +| Krita | Pass | Interactive validation pending | Intentional exceptions: @@ -31,6 +31,9 @@ Intentional exceptions: exception. Chrome, Brave Origin and Edge use pasta-isolated loopback. - **Brave Origin and Edge are backup browsers.** They intentionally have no PulseAudio, Camera, ScreenCast or MPRIS grants. +- **Firefox camera and remote screen sharing are intentionally disabled.** Firefox does not support + the XDG Camera/ScreenCast portal path used here, so enabling them would require granting raw video + devices or the direct PipeWire socket. We deliberately do not grant those privileges. ## Browser smoke test