Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My Firefox configuration is tricky:

  1. Firefox runs at separate restricted user account which cannot connect to main X server.
  2. Firefox uses Xvfb (virtual "headless" X server) as X server.
  3. x11vnc is running on that Xvfb.
  4. On the main X server there is vncviewer running that connect to this x11vnc

On powerful laptop (Acer Extensa 5220) it seems to work more or less well, but on "Acer Aspire One" netbook it is slowish (on a background that firefox is loaded with lots of extensions).

How to optimise this scheme? Requirements:

  1. Browser cannot connect to main X server.
  2. Browser should be in chroot jail (no "suid" scripts, readonly for many things)
  3. Browser should have a lot of features (like in AutoPager, NoScript, WoT, AdBlockPlus)
share|improve this question
    
IMHO, X11 separation is just paranoia. –  grawity Feb 20 '11 at 14:53
    
@grawity, Browser is expected to be affected by various security exploits. If browser runs malicious native code, it can connect to X server and input commands there, so gain elevated access. I don't want main browser to be a trusted component. –  Vi. Feb 20 '11 at 17:31
    
@Vi. You may find qubes-os.org interesting, it is an OS based on xen + small virtualized linux guests, and guests can't access the main X server directly. Basically, it implements everything you want (including separate virtual hard disk instead of a chroot), but evrything's pre-configured for you :) . –  Georges Dupéron May 12 at 13:55
    
@GeorgesDupéron, How to attain decent GUI performance without giving direct access to X server? The main questoin is what to put between X and the browser. –  Vi. May 12 at 15:03
    
Well, I know little about qubes-os, but it seems that they use a custom protocol to communicate efficiently between the Xorg in the VM and the Xorg on the host. You should definitely read this page : wiki.qubes-os.org/trac/wiki/GUIdocs even if you don't agree with some of their implementation choices, it may give you some ideas. –  Georges Dupéron May 12 at 15:26

1 Answer 1

Try using Xephyr as the X11 server.

Another possibility is to run Firefox over a SSH connection to localhost, with restricted X11 forwarding. The OpenSSH ssh client has options ForwardX11 and ForwardX11Trusted; disable the latter in ~/.ssh/config.

share|improve this answer
    
Will SSH approach it prevent Firefox from running things like x11vnc and controlling all application connected to the same X server? –  Vi. Feb 20 '11 at 17:32
    
@Vi: Untrusted clients will not have access to windows created by any other program. –  grawity Feb 20 '11 at 18:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.