Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Firefox is open source software and can't be intended to do bad things, but the plugins, as I know, aren't open source. Can they be intended to do bad things? Is there any good idea to supervise them or to control their behavior?

share|improve this question

2 Answers 2

I agree with the other answer about using NoScript, that's really the quickest and easiest ways to limit when executable web content is run.

If you want to really lock down your Firefox session in Fedora, you can use the sandbox tool. Here's Dan Walsh's blog post about it. What this does is run the entire firefox session inside an selinux-contained session. You can explicitly list what directories or files the process can read. This is actually rather limiting, you've got a locked in window size and you can't copy/paste to and from the firefox session.

Chromium actually does a better job (IMO) of sandboxing plugins. On Fedora, the plugins run with a particular selinux context, and can only touch files in your home directory with the correct context applied, which limits their ability to "escape" and read other files on your disk.

share|improve this answer

Yes. They can do bad things. Addons from Mozilla's own site have some rudimentary review, but could still be dangerous. As the disclaimer you see when installing an add-on goes, only install extensions by authors you trust.

If you are using a system which supports SELiinux, like Fedora or Red Hat Enterprise Linux, the actions of the browser can be constrained, adding a layer of protection. However, by default, this doesn't do much, as people expect their browser to be able to save arbitrary files.

(Disclaimer: I work for Red Hat on Fedora.)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.