1

I need to run my browser as root, in order to gain Citrix receiver, which is executed within the browser, permissions to access and edit the hosts file.

Otherwise I get this error:

You do not have permission to change hosts file. Please verify that you have write permissions in the /etc directory.

Apparently Citrix needs access to hosts and the only way, I know of, is executing Firefox as root by:

sudo firefox

Are there any security issues when executing the browser as root?

Is there any way to make the hosts file permanently editable, so that I don't have to execute Firefox as root?

Update 1

As suggested by mikeserv, I executed

cp /etc/hosts /tmp
sudo unshare -m sh -c '
    mount -B /tmp/hosts /etc/hosts
    exec runuser -u '"$USER"' firefox'

In the newly opened instance of firefox I tried to access my ressources with Citrix, but got the same error as above.
Besides, I got the following error dump in the terminal:

1449062781808   addons.xpi  WARN    Can't iterate directory /home/user/.mozilla/firefox/2vytc6tm.default/extensions: [Exception... "Component returned failure code: 0x80520015 (NS_ERROR_FILE_ACCESS_DENIED) [nsIFile.directoryEntries]"  nsresult: "0x80520015 (NS_ERROR_FILE_ACCESS_DENIED)"  location: "JS frame :: resource://gre/modules/addons/XPIProvider.jsm :: getDirectoryEntries :: line 1713"  data: no] Stack trace: getDirectoryEntries()@resource://gre/modules/addons/XPIProvider.jsm:1713 < DirInstallLocation__readAddons()@resource://gre/modules/addons/XPIProvider.jsm:7502 < DirectoryInstallLocation()@resource://gre/modules/addons/XPIProvider.jsm:7441 < addDirectoryInstallLocation()@resource://gre/modules/addons/XPIProvider.jsm:2298 < XPI_startup()@resource://gre/modules/addons/XPIProvider.jsm:2347 < callProvider()@resource://gre/modules/AddonManager.jsm:221 < _startProvider()@resource://gre/modules/AddonManager.jsm:828 < AMI_startup()@resource://gre/modules/AddonManager.jsm:999 < AMP_startup()@resource://gre/modules/AddonManager.jsm:2672 < AMC_observe()@resource://gre/components/addonManager.js:58 < <file:unknown>

(firefox:7994): GConf-WARNING **: Client failed to connect to the D-BUS daemon:
Failed to connect to socket /tmp/dbus-9dyvIdS0jP: Verbindungsaufbau abgelehnt

(firefox:7994): GConf-WARNING **: Client failed to connect to the D-BUS daemon:
Failed to connect to socket /tmp/dbus-CBkXMgnC2r: Verbindungsaufbau abgelehnt

(firefox:7994): LIBDBUSMENU-GLIB-WARNING **: Unable to get session bus: Verbindung ist gescheitert: Verbindungsaufbau abgelehnt

(firefox:7994): dconf-CRITICAL **: unable to create file '/home/user/.cache/dconf/user': Keine Berechtigung.  dconf will not work properly.

(firefox:7994): dconf-CRITICAL **: unable to create file '/home/user/.cache/dconf/user': Keine Berechtigung.  dconf will not work properly.

...

(firefox:7994): GConf-WARNING **: Client failed to connect to the D-BUS daemon:
Failed to connect to socket /tmp/dbus-dMG4PGVMeg: Verbindungsaufbau abgelehnt

(firefox:7994): dconf-CRITICAL **: unable to create file '/home/user/.cache/dconf/user': Keine Berechtigung.  dconf will not work properly.

(firefox:7994): GConf-WARNING **: Client failed to connect to the D-BUS daemon:
Failed to connect to socket /tmp/dbus-jIIyll6Cjh: Verbindungsaufbau abgelehnt

...

Update 2

JVMLauncher.afterStart(): starting JVM process watcher

(wfica:4510): GLib-CRITICAL **: Source ID 75 was not found when attempting to remove it

(wfica:4510): GLib-CRITICAL **: Source ID 127 was not found when attempting to remove it
10
  • 3
    Changing perms on /etc/hosts is not a good idea. If any software asks for your browser to be run as root it has serious design issues, IMHO.
    – schaiba
    Nov 24 '15 at 12:25
  • @schaiba: It doesn't explicitly ask to run my browser as root, but it needs full acces to hosts and, afaik, it's the only way to gain those rights. Nov 24 '15 at 12:33
  • Can you link us to a page where it says that it needs r/w access to /etc/hosts ? I can't seem to find it myself.
    – schaiba
    Nov 24 '15 at 12:45
  • @schaiba: I couldn't find a suitable link, but when trying to run it as normal user I get an error message, saying that it has no access to hosts. I tested in on several systems (Windows 7,8,10) and now on Ubuntu. Nov 24 '15 at 13:13
  • hosts or /etc/hosts ?
    – schaiba
    Nov 24 '15 at 13:16
1

with a linux mount namespace you can get close to the same effect but with substantially less liability.

cp /etc/hosts /tmp
sudo -E unshare -m sh -c '
    mount -B /tmp/hosts /etc/hosts
    runuser -p '"$USER"' -c firefox'
5
  • 1
    Unfortunately, it won't work. Please see my update. Dec 2 '15 at 13:35
  • @user1170330 - yeah - its probably environment stuff. a little testing and i made it work for me... see the edit.
    – mikeserv
    Dec 2 '15 at 17:42
  • This time a get another error, please see Update 2. Dec 9 '15 at 13:40
  • 1
    @user1170330 - look this a possible solution. i cant possibly know what all of that stuff is - i dont have a clear understanding of why the programs you want to run require you to lower your defenses. but all i offered you was a solution which might allow you to lower them less. otherwise, given a problem like this, you need to sort it out with the vendor.
    – mikeserv
    Dec 9 '15 at 16:31
  • @user1170330 I must agree with mikeserv. If the vendor of the browser demands reduced security, then the vendor cannot be trusted. If I were to run such a thing (unlikely) It would be run on independent hardware that other hardware ignores because it is just not credible.
    – killermist
    Dec 27 '15 at 1:05
1

Do not set write permissions to /etc/hosts because you are in risk that an attacker redirects your traffic to the website which is under control and thus perform nefarious actions such as drive-by download attacks that could lead to installing malware on your computer without your consent by crafting a malicious JavaScript code that could exploit the vulnerabilities of your Firefox browser or one of its plugins/extensions. The same file on Windows OS is targeted by malware authors to spread trojans. Only you the owner must have the right to write it.

2
  • So executing firefox as root would be a less risky solution in my case? Dec 2 '15 at 12:04
  • 1
    See @mikeserv's solution above. Running a browser as root is a faux pas except for out-of-the-ordinary cases and/or testing purposes.
    – schaiba
    Dec 2 '15 at 13:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.