Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Harden and secure browsers in containers, with GUI

crlf.link

Post reply on HN
Print view View original

1–10 of 32 posts

Re: Harden and secure browsers in containers, with GUI

#3

Post by fsflover »

gigatexal wrote: post #2

I love this idea but it's broken a bit if webcams and mics can't be used at least for my use-case. If I had some time I'd look into extending that with this project.

Have a look at Qubes OS then : https://qubes-os.org. It's even more secure (hardware VT-d virtualization), with a nice gui and allows to use webcams and microphones securely.

Re: Harden and secure browsers in containers, with GUI

#4

Post by usr1106 »

gigatexal wrote: post #2

I love this idea but it's broken a bit if webcams and mics can't be used at least for my use-case. If I had some time I'd look into extending that with this project.

Pulseaudio has network support. You should be able to share your microphone. Of course you need to run pulseaudio inside the container, too. So it's no longer an application container, but a system container.

I used system containers in the past, they are not always easy. No idea whether it would work with podman.

Now that I think about it: The browser obviously uses the display of the host. How? Only over X11 network protocol? That worked in the past, does it still work today? I thought modern browsers would need /dev/dri/? If that is made available, why would Webcams not be possible?

Re: Harden and secure browsers in containers, with GUI

#6

Post by thefr0g »

usr1106 wrote: post #4
gigatexal wrote: post #2

I love this idea but it's broken a bit if webcams and mics can't be used at least for my use-case. If I had some time I'd look into extending that with this project.

Pulseaudio has network support. You should be able to share your microphone. Of course you need to run pulseaudio inside the container, too. So it's no longer an application container, but a system container. I used system containers in the past, they are not always easy. No idea whether it would work with podman. Now that I think about it: The browser obviously uses the display of the host. How? Only over X11 networ…

> Only over X11 network protocol?

If you read the examples you'll see that they mount /tmp/.X11-unix in the container, thats where the X-Sessions Unix domain socket is. You can do the same for pulseaudio. But you shouldn't. Use Wayland and Pipewire if you are actually interested in using this as a security measure, since they are built for sandboxing.

> I thought modern browsers would need /dev/dri/?

They only need it for hw-acceleration. You can also give the container access to it if you need that.

Re: Harden and secure browsers in containers, with GUI

#8

Post by mfontani »

gigatexal wrote: post #2

I love this idea but it's broken a bit if webcams and mics can't be used at least for my use-case. If I had some time I'd look into extending that with this project.

For the (few) docker-based browser containers I use, I simply bind-mount[1] the relative devices and (in Chrome) it all just works.

For Chrome inside a container, I also install the Google Talk plug-in. Unsure if that's still required, but things work well.

[1]: i.e. "--group-add plugdev", "--device /dev/hidraw4", "--device /dev/video4", "--device /dev/snd", "--device /dev/sri" and similar

Re: Harden and secure browsers in containers, with GUI

#9

Post by raesene9 »

Now that WSLg support (https://github.com/microsoft/wslg) has landed in a release version of windows, another approach to this is to create new WSL distros for specific tasks, and run browsers from them.

Whilst it's a VM, I've found start-up time for WSL instances to be pretty quick, and it's pretty easy to create and clone a template VM (one approach https://raesene.github.io/blog/2020/05/31/Custom_Pentest_Dis... )

Re: Harden and secure browsers in containers, with GUI

#10

Post by gigatexal »

mfontani wrote: post #8
gigatexal wrote: post #2

I love this idea but it's broken a bit if webcams and mics can't be used at least for my use-case. If I had some time I'd look into extending that with this project.

For the (few) docker-based browser containers I use, I simply bind-mount[1] the relative devices and (in Chrome) it all just works. For Chrome inside a container, I also install the Google Talk plug-in. Unsure if that's still required, but things work well. [1]: i.e. "--group-add plugdev", "--device /dev/hidraw4", "--device /dev/video4", "--device /dev/snd", "--device /dev/sri" and similar

I almost don't want to ask as I know the answer is likely to be not great but can this also be done on mac?
Post reply on HN