Try Firefox in a managed directory again

5 files changed, 115 insertions, 53 deletions

diff --git a/.config/firefox/chrome/userChrome.css b/.config/firefox/chrome/userChrome.css
new file mode 100644
index 0000000..e2ab027
--- /dev/null
+++ b/.config/firefox/chrome/userChrome.css
@@ -0,0 +1,18 @@
+/* Hide default tab bar */
+#main-window[tabsintitlebar="true"]:not([extradragspace="true"]) #TabsToolbar > .toolbar-items {
+    opacity: 0;
+    pointer-events: none;
+}
+#main-window:not([tabsintitlebar="true"]) #TabsToolbar {
+    visibility: collapse !important;
+}
+
+/* Hide header of sidebar */
+#sidebar-header {
+    display: none;
+}
+
+/* Make unread tabs italic */
+tab-item.unread .label-content {
+    font-style: italic;
+}
diff --git a/.config/firefox/user.js b/.config/firefox/user.js
new file mode 100644
index 0000000..1da44b4
--- /dev/null
+++ b/.config/firefox/user.js
@@ -0,0 +1,29 @@
+// Settings changed after going through properties
+user_pref("app.shield.optoutstudies.enabled", false);
+user_pref("browser.ctrlTab.recentlyUsedOrder", false);
+user_pref("browser.download.dir", "/home/tyil/downloads/firefox");
+user_pref("browser.download.folderList", 2);
+user_pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons", false);
+user_pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features", false);
+user_pref("browser.newtabpage.activity-stream.feeds.section.highlights", false);
+user_pref("browser.newtabpage.activity-stream.feeds.snippets", false);
+user_pref("browser.newtabpage.activity-stream.feeds.topsites", false);
+user_pref("browser.newtabpage.activity-stream.showSearch", false);
+user_pref("browser.newtabpage.enabled", false);
+user_pref("browser.search.hiddenOneOffs", "Google,Bing,Amazon.com,eBay,Twitter");
+user_pref("browser.search.suggest.enabled", false);
+user_pref("browser.startup.homepage", "https://searx.tyil.nl");
+user_pref("browser.startup.page", 3);
+user_pref("browser.urlbar.placeholderName", "DuckDuckGo");
+user_pref("general.smoothScroll", false);
+user_pref("privacy.donottrackheader.enabled", true);
+
+// Make Firefox load userChrome.css again...
+user_pref("toolkit.legacyUserProfileCustomizations.stylesheets", true);
+
+// Disable whatever trash Firefox devs are pushing these days
+user_pref("extensions.pocket.enabled", false);
+user_pref("media.videocontrols.picture-in-picture.enabled", false);
+user_pref("media.videocontrols.picture-in-picture.video-toggle.enabled", false);
+user_pref("network.trr.mode", 5); // DoH
+user_pref("pdfjs.disabled", true);
diff --git a/.local/bin/firefox b/.local/bin/firefox
new file mode 100755
index 0000000..22d7a79
--- /dev/null
+++ b/.local/bin/firefox
@@ -0,0 +1,46 @@
+#!/bin/sh
+
+# This program is free software: you can redistribute it and/or modify it under
+# the terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+# details.
+
+readonly BINS="
+	/usr/bin/firefox
+	/usr/bin/firefox-bin
+"
+
+main()
+{
+	require_exe "firejail"
+
+	for bin in $BINS
+	do
+		[ -x "$bin" ] || continue
+
+		exec firejail --profile="$HOME/.local/etc/firejail/firefox.profile" -- "$bin" "$@"
+	done
+
+	printf "No underlying executable found for %s:\n" "${0##*/}" >&2
+
+	for bin in $BINS
+	do
+		printf "\t%s\n" "$bin" >&2
+	done
+}
+
+require_exe()
+{
+	if ! which "$1" 2>&1 > /dev/null
+	then
+		printf "Missing required executable %s\n" "$1"
+		exit 3
+	fi
+}
+
+main "$@"
diff --git a/.local/etc/firejail/firefox.profile b/.local/etc/firejail/firefox.profile
new file mode 100644
index 0000000..3fcb6d9
--- /dev/null
+++ b/.local/etc/firejail/firefox.profile
@@ -0,0 +1,19 @@
+# Limited access to homedir contents
+whitelist ~/.config/firefox
+whitelist ~/.config/gtk-3.0
+whitelist ~/.mozilla/firefox
+whitelist ~/documents
+whitelist ~/downloads/firefox
+whitelist ~/pictures
+
+read-only ~/.config/gtk-3.0
+read-only ~/documents
+read-only ~/pictures
+
+# Use private system resources
+private-tmp
+
+# Remove executable bits
+noexec /tmp
+
+caps.drop all
diff --git a/README.md b/README.md
index 0bc5894..61883cb 100644
--- a/README.md
+++ b/README.md
@@ -47,59 +47,9 @@ rest are even worse.
 
 ### Firefox (nightly)
 
-The Firefox configuration files live in a random directory in
-`$HOME/.mozilla/firefox`.
-
-#### `user.js`
-
-```js
-// Settings changed after going through properties
-user_pref("app.shield.optoutstudies.enabled", false);
-user_pref("browser.ctrlTab.recentlyUsedOrder", false);
-user_pref("browser.download.dir", "/home/tyil/downloads/firefox");
-user_pref("browser.download.folderList", 2);
-user_pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons", false);
-user_pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features", false);
-user_pref("browser.newtabpage.activity-stream.feeds.section.highlights", false);
-user_pref("browser.newtabpage.activity-stream.feeds.snippets", false);
-user_pref("browser.newtabpage.activity-stream.feeds.topsites", false);
-user_pref("browser.newtabpage.activity-stream.showSearch", false);
-user_pref("browser.newtabpage.enabled", false);
-user_pref("browser.search.hiddenOneOffs", "Google,Bing,Amazon.com,eBay,Twitter");
-user_pref("browser.search.suggest.enabled", false);
-user_pref("browser.startup.homepage", "https://searx.tyil.nl");
-user_pref("browser.startup.page", 3);
-user_pref("browser.urlbar.placeholderName", "DuckDuckGo");
-user_pref("general.smoothScroll", false);
-user_pref("privacy.donottrackheader.enabled", true);
-user_pref("network.trr.mode", 5);
-
-// Make Firefox load userChrome.css again...
-user_pref("toolkit.legacyUserProfileCustomizations.stylesheets", true);
-```
-
-#### `chrome/userChrome.css`
-
-```css
-/* Hide default tab bar */
-#main-window[tabsintitlebar="true"]:not([extradragspace="true"]) #TabsToolbar > .toolbar-items {
-    opacity: 0;
-    pointer-events: none;
-}
-#main-window:not([tabsintitlebar="true"]) #TabsToolbar {
-    visibility: collapse !important;
-}
-
-/* Hide header of sidebar */
-#sidebar-header {
-    display: none;
-}
-
-/* Make unread tabs italic */
-tab-item.unread .label-content {
-    font-style: italic;
-}
-```
+Start Firefox with `-p` first, create a new profile and set the directory to
+`~/.config/firefox`. This *should* be enough for the configuration files,
+however, addons still need to be managed by hand.
 
 #### Addons