├── live-build
└── config
│ ├── archives
│ ├── experimental.list.chroot
│ └── experimental.pref.chroot
│ ├── hooks
│ └── 0510-root-password.hook.chroot
│ ├── includes.chroot
│ ├── etc
│ │ ├── firejail
│ │ │ ├── firefox.profile
│ │ │ └── blacklist-dev.inc
│ │ ├── rc.local
│ │ └── iceweasel
│ │ │ └── profile
│ │ │ ├── searchplugins
│ │ │ ├── startpage-ssl.xml
│ │ │ └── wikipedia-ssl.xml
│ │ │ └── prefs.js
│ └── lib
│ │ └── live
│ │ └── config
│ │ └── 1200-setattr
│ └── package-lists
│ └── my.list.chroot
├── README.md
└── GUIDE.md
/live-build/config/archives/experimental.list.chroot:
--------------------------------------------------------------------------------
1 | deb http://ftp.debian.org/debian unstable main
2 | deb http://ftp.debian.org/debian experimental main
3 |
--------------------------------------------------------------------------------
/live-build/config/hooks/0510-root-password.hook.chroot:
--------------------------------------------------------------------------------
1 | #!/bin/sh
2 |
3 | set -e
4 |
5 | usermod -p '$5$GxpbCxvGOmtudd$uL90C.ZOMY6WxI4.x32kTCv38dGiXYUlfWGzCQuHmr3' root
6 |
7 |
--------------------------------------------------------------------------------
/live-build/config/archives/experimental.pref.chroot:
--------------------------------------------------------------------------------
1 | Package: iceweasel
2 | Pin: release a=experimental
3 | Pin-Priority: 995
4 |
5 | Package: *
6 | Pin: release a=unstable
7 | Pin-Priority: 1
8 |
--------------------------------------------------------------------------------
/live-build/config/includes.chroot/etc/firejail/firefox.profile:
--------------------------------------------------------------------------------
1 | # Firejail profile for Mozilla Firefox (Iceweasel in Debian)
2 | include /etc/firejail/disable-mgmt.inc
3 | include /etc/firejail/disable-secret.inc
4 | include /etc/firejail/blacklist-dev.inc
5 | blacklist ${HOME}/.adobe
6 | blacklist ${HOME}/.macromedia
7 | caps
8 | seccomp
9 |
--------------------------------------------------------------------------------
/live-build/config/includes.chroot/etc/rc.local:
--------------------------------------------------------------------------------
1 | #!/bin/sh -e
2 | #
3 | # rc.local
4 | #
5 | # This script is executed at the end of each multiuser runlevel.
6 | # Make sure that the script will "exit 0" on success or any other
7 | # value on error.
8 | #
9 | # In order to enable or disable this script just change the execution
10 | # bits.
11 | #
12 | # By default this script does nothing.
13 |
14 |
--------------------------------------------------------------------------------
/live-build/config/package-lists/my.list.chroot:
--------------------------------------------------------------------------------
1 | task-english pm-utils alsa-utils unzip screen curl iceweasel spice-vdagent fluxbox attr xserver-xorg-video-modesetting xserver-xorg-video-qxl xserver-xorg-input-evdev xinit x11-apps x11-utils x11-xserver-utils rxvt-unicode iceweasel-noscript iceweasel-perspectives iceweasel-refcontrol iceweasel-requestpolicy iceweasel-openinbrowser iceweasel-https-everywhere
2 |
--------------------------------------------------------------------------------
/live-build/config/includes.chroot/lib/live/config/1200-setattr:
--------------------------------------------------------------------------------
1 | #!/bin/sh
2 |
3 | Init ()
4 | {
5 | echo -n " setattr"
6 | }
7 |
8 | Config ()
9 | {
10 | if [ -f /usr/bin/iceweasel -a -f /usr/bin/setfattr ]; then
11 | setfattr -n user.pax.flags -v m /usr/bin/iceweasel
12 | setfattr -n user.pax.flags -v m /usr/lib/iceweasel/plugin-container
13 | fi
14 |
15 | # Creating state file
16 | touch /var/lib/live/config/setattr
17 | }
18 |
19 | Init
20 | Config
21 |
--------------------------------------------------------------------------------
/live-build/config/includes.chroot/etc/firejail/blacklist-dev.inc:
--------------------------------------------------------------------------------
1 | seccomp mknod
2 |
3 | blacklist /dev/autofs
4 | blacklist /dev/block
5 | blacklist /dev/btrfs-control
6 | blacklist /dev/bus
7 | blacklist /dev/char
8 | blacklist /dev/console
9 | blacklist /dev/cpu
10 | blacklist /dev/cpu_dma_latency
11 | blacklist /dev/disk
12 | blacklist /dev/dri
13 | blacklist /dev/fb0
14 | blacklist /dev/fd
15 | blacklist /dev/full
16 | blacklist /dev/fuse
17 | blacklist /dev/grsec
18 | blacklist /dev/hpet
19 | blacklist /dev/hugepages
20 | blacklist /dev/initctl
21 | blacklist /dev/input
22 | blacklist /dev/kmsg
23 | blacklist /dev/log
24 | blacklist /dev/loop*
25 | blacklist /dev/mapper
26 | blacklist /dev/mcelog
27 | blacklist /dev/mem
28 | blacklist /dev/memory_bandwidth
29 | blacklist /dev/mqueue
30 | blacklist /dev/psaux
31 | blacklist /dev/ptmx
32 | blacklist /dev/pts
33 | blacklist /dev/rtc
34 | blacklist /dev/rtc0
35 | blacklist /dev/shm
36 | blacklist /dev/tty*
37 | blacklist /dev/uinput
38 | blacklist /dev/vcs*
39 | blacklist /dev/vda*
40 | blacklist /dev/vga_arbiter
41 | blacklist /dev/vhost-net
42 | blacklist /dev/virtio*
43 | blacklist /dev/vport*
44 | blacklist /dev/xconsole
45 |
--------------------------------------------------------------------------------
/live-build/config/includes.chroot/etc/iceweasel/profile/searchplugins/startpage-ssl.xml:
--------------------------------------------------------------------------------
1 |
2 | Startpage (SSL)
3 | Startpage is a search engine that does not collect or share personally identifiable information. This search bar extension utilizes SSL to protect transmissions between You and Startpage.
4 | UTF-8
5 | data:image/x-icon;base64,AAABAAEAEBAAAAEAIABoBAAAFgAAACgAAAAQAAAAIAAAAAEAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD2jkj+9YtD/vWLQ/71i0P+9otD/vaLRP72i0T+9YtE/vWLRP72i0T+9otD/vaNRP72jUT+9otF/vaLRf73kkv+9Yc///WJP//1iT//9Yk///rAmf/94Mz/+sCa//aRTv/1iUH/9ok///aJP//2i0H/9otB//aJQv/2iUL/9otC//aNRP/2jUT/9o1E//aNRP/6wpv////////////96dr/95dQ//aNRP/2kET/9pBG//aQRv/2kEb/9pBG//aRR//3lEz/95BH//mueP/7xJ3/959g//efYf/4p23//vDm//3p2//3kEr/95FJ//aRSf/niFH/95FK//aRSv/2mE//95hS/vq4iP/////////////////81bj/95xZ//q4iP//////+bF+//eZT//njFT/PSqi/2xGjv/2mVD/951V/vedVv783cX///////vQrf/++PP///////748//+8uj///////m3gf/olFr/PSuj/w8Pt/9sSJD/951V//eeWf73oVv++8ul///////5sXf/+KRi//vRsf////////////3r3v/olF//Piyk/w8Pt/9sSJH/+J5Z//ieWv/3oV/++KZf/vihXP/97N7//vn0//zTs//6wJP/+bBy//q6iP/onW//Piyl/w8Pt/8fGbH/m2iB/+icY//4pGD/96hl/viqZf74pmD/+Kxr//3iy/////////n1//ivbP/onGj/Pi2m/w8Pt/8uJKz/fFeQ/x8Zsf8+Lqb/6J9r//ivbP74rm3++Klm//mpZv/5q2f/+bR9//m0e//poW7/Pi6n/w8Pt/9sTZj/+Ktp//ira/+rd4P/Dw+3/4xijv/5snH++LN1/vmvbf/5r23/+a5t//mvb//4r2//TTuk/w8Pt/8fGrL/6ah1//ivcP/4r3P/q3yI/w8Pt/+MZpP/+bN5/vm4ev75t3X/+bV1//m1df/5t3X/+Ld3/8qUhP98XZn/Hxqz/+mse//5t3f/2p+B/x8as/8PD7f/u4qK//m7fv76u4D++bl7//m3fP/5uXz/+bl8//m5fP/5t3z/+bl//x8as/9NPKf/fWCb/x8as/8PD7f/bVOh//q5f//6v4X++sGI/vm9g//5voX/+b6F//m9hf/6vYX/+r6F//nCh/+bepr/Hxu0/w8Pt/8PD7f/fWOh//q+hf/6wof/+saN/vrGjf75xIv/+ceL//nEi//5xIv/+sSL//rHi//6x43/+ceN/+m7kP+7lpj/6ruQ//rHkP/6x43/+seQ//rLlf76ypT++seR//rJkf/6yZH/+seR//rJkf/6yZH/+8mR//vJlP/7yZT/+smU//rJlP/6yZT/+8yV//rJlf/6zpn+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
6 | https://startpage.com/
7 |
8 |
9 |
10 |
11 |
12 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # Live-Armor
2 |
3 | This repository contains the
4 | [Live-Armor Guide](https://fatemachine.github.io/live-armor/), a guide
5 | to building custom Linux
6 | [live images](https://en.wikipedia.org/wiki/Live_CD) for security
7 | sandboxing using tools from the [Debian](https://www.debian.org)
8 | [Live Systems](http://www.live-systems.org/) project and
9 | [Grsecurity](https://www.grsecurity.net/).
10 |
11 | The `live-build` directory contains an example configuration for Debian
12 | [live-build](http://live-systems.org/manual/current/html/live-manual/installation.en.html#118)
13 | that can be used as a starting point for building a custom live image.
14 | This configuration is based on the one covered in the Guide.
15 |
16 | ## Quick Start
17 |
18 | 1. Install [live-build
19 | 5.0](https://packages.debian.org/experimental/live-build).
20 |
21 | 1. Create an empty directory that will contain your live image
22 | configuration and build data.
23 |
24 | 1. Change to your live image directory and run: `lb config`
25 |
26 | 1. Copy the `live-build/config` tree of this repository into the
27 | `config` subdirectory that `lb config` just created, for example by
28 | using `cp -r`.
29 |
30 | 1. Edit `config/binary` and add the `union=overlay` and optionally
31 | `live-config.noroot` kernel boot parameters to the
32 | `LB_BOOTAPPEND_LIVE` and `LB_BOOTAPPEND_LIVE_FAILSAFE` variables.
33 |
34 | If you added `live-config.noroot` to disable sudo, choose your root
35 | password by running `mkpasswd` (part of the
36 | [whois](https://packages.debian.org/whois) package) and replace the
37 | argument to `usermod -p` in
38 | `config/hooks/0510-root-password.hook.chroot` with the output of
39 | `mkpasswd`.
40 |
41 | If you did not add `live-config.noroot` and are therefore using the
42 | default unprotected sudo access method, delete
43 | `config/hooks/0510-root-password.hook.chroot`.
44 |
45 | Note: The default login credentials are username `user` and password
46 | `live`.
47 |
48 | 1. Edit `config/chroot` and change `LB_UNION_FILESYSTEM="aufs"` to
49 | `LB_UNION_FILESYSTEM="overlay"`.
50 |
51 | 1. Inspect the list of custom packages in
52 | `config/package-lists/my.list.chroot` and make any desired changes.
53 |
54 | 1. Add `.deb` package files to the `config/packages.chroot` directory:
55 |
56 | * Your custom live system kernel package, with a name that begins
57 | with `linux-image`. See the Guide for instructions on configuring
58 | and building a custom kernel.
59 | * `live-boot` and `live-boot-initramfs-tools` packages patched for
60 | OverlayFS support. See the Guide for instructions.
61 | * `live-config` and `live-config-systemd` package versions that match
62 | the `live-boot` version, for example from Debian `experimental`.
63 |
64 | 1. Re-run `lb config`.
65 |
66 | 1. Build your live image: `lb build 2>&1 | tee build.log`
67 |
68 | This configuration has been tested with the following software versions:
69 |
70 | - Debian [jessie](https://www.debian.org/releases/jessie/)
71 | - Linux [kernel](https://www.kernel.org/) version 3.18.x
72 | - [live-build](https://packages.debian.org/live-build) 5.0a3
73 | - [live-boot](https://packages.debian.org/live-boot) and
74 | [live-config](https://packages.debian.org/live-config) 5.0a1, with
75 | live-boot patched for OverlayFS support
76 | - [QEMU](https://packages.debian.org/qemu-system-x86) 2.1
77 |
--------------------------------------------------------------------------------
/live-build/config/includes.chroot/etc/iceweasel/profile/searchplugins/wikipedia-ssl.xml:
--------------------------------------------------------------------------------
1 |
2 | Wikipedia (SSL)
3 | Wikipedia is an openly-editable, free content internet encyclopedia. This search bar add-on utilizes SSL to protect searches between You and Wikipedia.
4 | UTF-8
5 | data:image/x-icon;base64,AAABAAMAMDAQAAEABABoBgAANgAAACAgEAABAAQA6AIAAJ4GAAAQEBAAAQAEACgBAACGCQAAKAAAADAAAABgAAAAAQAEAAAAAAAABgAAAAAAAAAAAAAQAAAAAAAAAAEBAQAXFxcAMDAwAEdHRwBYWFgAZ2dnAHZ2dgCHh4cAlZWVAKmpqQC3t7cAx8fHANfX1wDo6OgA/v7+AAAAAAD////+7u7u7u7u7u7u7u7u7u7u7u///////+7u7u7u7u7u7u7u7u7u7u7u7u7u/////u7u7u7u7u7u7u7u7u7u7u7u7u7u7///7u7u7u7u7u7u7u7u7u7u7u7u7u7u7v/+7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u/+7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u/+7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u/u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7sa+7u7u7u1b7u7u7u7u7u7u7u7u7u7u7p9u7u7u7ugG7u7u7u7u7u7u7u7u7u7u7TAa7u7u7tQBzu7u7u7u7u7u7u7u7u7u6wAF7u7u7pAAju7u7u7u7u7u7u7u7u7u1AAAru7u7U//Le7u7u7u7u7u7u7u7u7uz/8RPe7u6gAB+e7u7u7u7u7u7u7u7u7ubw94Ce7u1QAIIu7u7u7u7u7u7u7u7u7tH/G+Mt7usAAtcL7u7u7u7u7u7u7u7u7n8ATun47uQACO0T7u7u7u7u7u7u7u7u7hDxnu4x3sAPLO5Qzu7u7u7u7u7u7u7u6P/z7u6wXk/wfu7ATu7u7u7u7u7u7u7u4QAY7u7kCQADzu7kDO7u7u7u7u7u7u7uoA8u7u7sAAAG7u7r9e7u7u7u7u7u7u7uIPB+7u7uUAAs7u7uMd7u7u7u7u7u7u7rEAHe7u7uQABu7u7un37u7u7u7u7u7u7kAAXu7u7sAPHe7u7u4S3u7u7u7u7u7u7BAA3u7u7k8AHO7u7u6Aju7u7u7u7u7u5g/07u7u7B8BBe7u7u7RLu7u7u7u7u7u0v/87u7u5QAGQa7u7u7nCe7u7u7u7u7ugAA+7u7uwQ8dsE7u7u7rBO7u7u7u7u7tP/++7u7uYAB+5Qnu7u7tQa7u7u7u7u7pH/Lu7u7sLwHe6xPe7u7ur27u7u7u7u7V//ru7u7mAAju7n+e7u7u0yvu7u7u7u6h8C3u7u6yAB3u7rEs7u7u6Pfu7u7u7u1AAE7u7u5g/27u7tQG3u7u6QHO7u7u7tbwAB3u7ukfAH7u7sIAju7u5wA97u7utiAAAAF76lAA/wWeyDAA84zqUAABfO7uMiNERDIm4iNERDIrkiNEQybiI0RDJO7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7+7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u/+7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u/+7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u//7u7u7u7u7u7u7u7u7u7u7u7u7u7u7v///u7u7u7u7u7u7u7u7u7u7u7u7u7u7////+7u7u7u7u7u7u7u7u7u7u7u7u7u///////+7u7u7u7u7u7u7u7u7u7u7u/////+AAAAAH8AAPAAAAAADwAA4AAAAAAHAADAAAAAAAMAAIAAAAAAAQAAgAAAAAABAACAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAABAACAAAAAAAEAAIAAAAAAAQAAwAAAAAADAADgAAAAAAcAAPAAAAAADwAA/gAAAAB/AAAoAAAAIAAAAEAAAAABAAQAAAAAAIACAAAAAAAAAAAAABAAAAAAAAAAAQEBABYWFgAnJycANTU1AEdHRwBZWVkAZWVlAHh4eACIiIgAmZmZAK6urgDMzMwA19fXAOnp6QD+/v4AAAAAAP//7u7u7u7u7u7u7u7u////7u7u7u7u7u7u7u7u7u7//u7u7u7u7u7u7u7u7u7u7/7u7u7u7u7u7u7u7u7u7u/u7u7u7u7u7u7u7u7u7u7u7u7u7u7X3u7u7I7u7u7u7u7u7u7uYF7u7uIK7u7u7u7u7u7u7QAM7u6vBO7u7u7u7u7u7ucABe7uMA/O7u7u7u7u7u7R8q/O6gCEbu7u7u7u7u7ukAnibuTx6g3u7u7u7u7u7hAe6gzP+O4Y7u7u7u7u7urwju4mXx7uge7u7u7u7u7jAd7uoACO7tCe7u7u7u7uoPfu7uEB3u7mPu7u7u7u7k8N7u7QBu7u6wru7u7u7uwAXu7ufwbu7u407u7u7u7lAM7u7RBQzu7ur87u7u7u0ATu7ucA0l7u7uFu7u7u7n/67u7RB+oL7u7nHe7u7u0fPu7ucA3uJO7u7Qju7u7o/67u7Q9u7q+u7u5R3u7u0Q/e7ub/vu7PLO7uX13u4w//Be4v/xnoH/+ekv//Xu7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7+7u7u7u7u7u7u7u7u7u7v/u7u7u7u7u7u7u7u7u7u7//u7u7u7u7u7u7u7u7u7v///+7u7u7u7u7u7u7u7v//8AAAD8AAAAOAAAABgAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAGAAAABwAAAA/AAAA8oAAAAEAAAACAAAAABAAQAAAAAAMAAAAAAAAAAAAAAABAAAAAAAAAAAQEBABcXFwAnJycAOzs7AElJSQBpaWkAeXl5AIaGhgCVlZUApqamALOzswDMzMwA2dnZAObm5gD+/v4AAAAAAP/u7u7u7u7//u7u7u7u7u/u7uzu7t7u7u7u4Y7lTu7u7u6QTtA77u7u7iaoctXu7u7qDOQZ5d7u7uRO5R7rbu7uv77iLu5O7u5D7pGn7pju7QrtKOTe4+6z+OT40z2RTO7u7u7u7u7u7u7u7u7u7u7+7u7u7u7u7//u7u7u7u7/wAMAD4ABAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA+AAQAPwAMADw==
6 | https://en.wikipedia.org/wiki/Special:Search
7 |
8 |
9 |
10 |
11 |
12 |
13 |
--------------------------------------------------------------------------------
/live-build/config/includes.chroot/etc/iceweasel/profile/prefs.js:
--------------------------------------------------------------------------------
1 | # Mozilla User Preferences
2 |
3 | /* Don't start finding text when any input is typed */
4 | user_pref("accessibility.typeaheadfind.autostart", false);
5 |
6 | /* Start with a simple blank page */
7 | user_pref("browser.startup.page", 1);
8 | user_pref("browser.startup.homepage", "about:about");
9 |
10 | /* Don't send every URL we visit to Google */
11 | user_pref("browser.safebrowsing.enabled", false);
12 | user_pref("browser.safebrowsing.malware.enabled", false);
13 |
14 | /* Don't save information entered in web forms and search bars */
15 | user_pref("browser.formfill.enable", false);
16 |
17 | /* Backspace goes back one page in history */
18 | user_pref("browser.backspace_action", 0);
19 |
20 | /* Ask where to save downloads */
21 | user_pref("browser.download.useDownloadDir", false);
22 |
23 | /* When JavaScript wants to open a new window, open a tab instead */
24 | user_pref("browser.link.open_newwindow.restriction", 0);
25 |
26 | /* Always use Private Browsing Mode */
27 | user_pref("browser.privatebrowsing.autostart", true);
28 |
29 | /* Disable search suggestions */
30 | user_pref("browser.search.suggest.enabled", false);
31 |
32 | /* Limit state information saved between sessions */
33 | user_pref("browser.sessionstore.max_tabs_undo", 5);
34 | user_pref("browser.sessionstore.resume_from_crash", false);
35 |
36 | /* Turn off tab animations */
37 | user_pref("browser.tabs.animate", false);
38 |
39 | /* Turn off URL bar funny business */
40 | user_pref("browser.urlbar.autocomplete.enabled", false);
41 | user_pref("browser.urlbar.trimURLs", false);
42 |
43 | /* Disallow JavaScript access to potentially dangerous APIs */
44 | user_pref("dom.event.clipboardevents.enabled", false);
45 | user_pref("dom.battery.enabled", false);
46 | user_pref("dom.disable_window_open_feature.menubar", true);
47 | user_pref("dom.disable_window_open_feature.personalbar", true);
48 | user_pref("dom.disable_window_open_feature.scrollbars", true);
49 | user_pref("dom.disable_window_open_feature.toolbar", true);
50 | user_pref("dom.popup_maximum", 10);
51 | user_pref("dom.storage.default_quota", 0);
52 |
53 | /* Override User-Agent data to mitigate browser fingerprinting.
54 | * See https://panopticlick.eff.org/
55 | */
56 | user_pref("general.appname.override", "Netscape");
57 | user_pref("general.appversion.override", "5.0 (Windows)");
58 | user_pref("general.buildID.override", 0);
59 | user_pref("general.oscpu.override", "Windows NT 6.2");
60 | user_pref("general.platform.override", "Win32");
61 | user_pref("general.productSub.override", "20100101");
62 | user_pref("general.useragent.override", "Mozilla/5.0 (Windows NT 6.2; rv:36.0) Gecko/20100101 Firefox/36.0");
63 | user_pref("general.useragent.vendor", "");
64 | user_pref("general.useragent.vendorSub", "");
65 | user_pref("general.warnOnAboutConfig", false);
66 | user_pref("intl.accept_languages", "en-us,en;q=0.5");
67 |
68 | /* Turn off "location aware browsing" */
69 | user_pref("geo.enabled", false);
70 |
71 | /* Turn off sending non-URL words entered in the URL bar to Google */
72 | user_pref("keyword.enabled", false);
73 |
74 | /* Turn off spell-checking */
75 | user_pref("layout.spellcheckDefault", 0);
76 |
77 | /* Disable cookies by default. Use an extension for site-specific
78 | * whitelisting.
79 | */
80 | user_pref("network.cookie.cookieBehavior", 2);
81 | user_pref("network.cookie.thirdparty.sessionOnly", true);
82 |
83 | /* Disable IPv6 unless you want to use it. */
84 | user_pref("network.dns.disableIPv6", true);
85 |
86 | /* Don't "proactively" perform DNS resolution */
87 | user_pref("network.dns.disablePrefetch", true);
88 |
89 | /* Unneeded unless we're using v6 */
90 | user_pref("network.http.fast-fallback-to-IPv4", false);
91 |
92 | /* Enable pipelining for better performance */
93 | user_pref("network.http.pipelining", true);
94 | user_pref("network.http.pipelining.maxrequests", 15);
95 | user_pref("network.http.pipelining.ssl", true);
96 | user_pref("network.http.proxy.pipelining", true);
97 | user_pref("network.http.redirection-limit", 5);
98 |
99 | /* Don't "proactively" fetch pages that haven't been requested */
100 | user_pref("network.prefetch-next", false);
101 |
102 | /* Disable Websockets by default */
103 | user_pref("network.websocket.enabled", false);
104 |
105 | /* Enable the Do-Not-Track header in HTTP requests */
106 | user_pref("privacy.donottrackheader.enabled", true);
107 |
108 | /* Clear Private Data when closing the browser */
109 | user_pref("privacy.sanitize.sanitizeOnShutdown", true);
110 |
111 | /* Disable unsafe RC4 ciphers */
112 | user_pref("security.ssl3.ecdhe_ecdsa_rc4_128_sha", false);
113 | user_pref("security.ssl3.ecdhe_rsa_rc4_128_sha", false);
114 | user_pref("security.ssl3.rsa_rc4_128_md5", false);
115 | user_pref("security.ssl3.rsa_rc4_128_sha", false);
116 |
117 | /* Disable WebGL by default */
118 | user_pref("webgl.disabled", true);
119 |
--------------------------------------------------------------------------------
/GUIDE.md:
--------------------------------------------------------------------------------
1 | # The Live-Armor Guide
2 | ## Building Custom Live Images with Debian and Grsecurity
3 |
4 | This guide explains how to build custom live system images for security
5 | sandboxing using tools from the [Debian](https://www.debian.org)
6 | [Live Systems](http://www.live-systems.org/) project and
7 | [Grsecurity](https://www.grsecurity.net).
8 |
9 | For concreteness we will focus on building a custom live image for
10 | sandboxing the Firefox web browser (also known as Iceweasel in the Debian
11 | world). However, the same tools and procedures will allow you to build any
12 | kind of Debian-based live image you want.
13 |
14 | - [Motivation](#motivation)
15 | - [Prerequisites](#prerequisites)
16 | - [Limitations and Alternatives](#limitations-and-alternatives)
17 | - [Architecture](#architecture)
18 | - [Layer 1: The Host System](#layer-1-the-host-system)
19 | - [Layer 2: The Guest Image](#layer-2-the-guest-image)
20 | - [Layer 3: Firejail](#layer-3-firejail)
21 | - [Layer 4: Firefox/Iceweasel Customization](#layer-4-firefoxiceweasel-customization)
22 |
23 | ## Motivation
24 |
25 | ### The browser problem
26 |
27 | If you're alive and technically aware in 2015, you know that Internet,
28 | operating system, and applications software are security disaster areas.
29 | End-user systems such as workstations and laptops are especially hard to
30 | protect against the growing tide of malware, most of it delivered via the
31 | Internet.
32 |
33 | After basic security measures have been taken, such as disabling unnecessary
34 | operating system services and firewalling network access, the largest attack
35 | surface on a typical end-user system today is the web browser. Popular
36 | browsers are large and complex pieces of software, invariably written in
37 | [unsafe](https://en.wikipedia.org/wiki/Memory_safety) languages for
38 | performance (although this may slowly be
39 | [changing](https://github.com/servo/servo)).
40 | [Critical](https://www.mozilla.org/en-US/security/advisories/)
41 | [vulnerabilities](http://www.cvedetails.com/vulnerability-list/vendor_id-1224/product_id-15031/opec-1/Google-Chrome.html)
42 | are discovered in popular browsers every month, any one of which can allow a
43 | remote attacker to take complete control over the computer running the
44 | browser. While this problem is now well known and recognized by browser
45 | vendors and efforts are being made to improve the status quo, building a
46 | secure browser has turned out to be a long and difficult road. Meanwhile,
47 | users are left adrift and vulnerable, and even the technically skilled have
48 | few good options for securing web browser installations.
49 |
50 | ### Live images
51 |
52 | A *live image* is a complete operating system image file (usually in
53 | [ISO format](https://en.wikipedia.org/wiki/ISO_image)) that can be loaded at
54 | system boot time from CD/DVD/USB media and that runs completely from RAM.
55 | No hard disk or any other form of persistent media is required. Changes can
56 | be made normally to the running system, but all changes are lost when the
57 | system is powered down or reset. (Some live images support an optional
58 | persistence partition that allows the user to store data that persists
59 | across restarts.)
60 |
61 | Live images are a powerful tool for
62 | [sandboxing](https://en.wikipedia.org/wiki/Sandbox_(computer_security)).
63 | Even if the live operating system or applications are compromised during
64 | runtime, the next reboot will restore the system to its original clean
65 | state. Simply using a live system is no guarantee of security, but it can
66 | make long-term compromise of a system significantly more difficult,
67 | especially when combined with other countermeasures as part of a
68 | top-to-bottom architecture that takes into account each layer from the
69 | lowest (physical setting) through the highest (user applications).
70 |
71 | ## Prerequisites
72 |
73 | This guide assumes you are an experienced systems administrator who is
74 | comfortable with Debian and with configuring and building the
75 | [Linux kernel](https://www.kernel.org/).
76 |
77 | ## Limitations and Alternatives
78 |
79 | The live image method is a relatively heavyweight approach to browser
80 | security. Configuring and building a custom live image takes time and
81 | skill, and using one is harder than using a browser directly. All
82 | browser customization must be done as part of live system configuration,
83 | which means that making even simple persistent changes to the browser
84 | requires updating the live configuration and rebuilding the live image.
85 | This is more work than most users are willing to put up with.
86 |
87 | There are a few alternatives:
88 |
89 | - Use a pre-built live system. This obviates the need to configure and
90 | build the live image yourself, and is ideal if you can find such an image
91 | that you trust and that closely matches your needs. Unfortunately, few
92 | such images seem to be available today that are built with security in
93 | mind. An exception is [Tails](https://tails.boum.org/), but it may not be
94 | suitable unless you want to route all data through Tor.
95 |
96 | - Use a [chroot](https://en.wikipedia.org/wiki/Chroot) jail. Setting up a
97 | secure chroot environment is a difficult task, and should only be
98 | attempted if you are fully aware of the security weaknesses of vanilla
99 | chroot environments and employ kernel hardening measures to guard against
100 | them, such as the chroot restrictions available in
101 | [Grsecurity](https://www.grsecurity.net/) kernels. A chroot jail provides
102 | a relatively thin barrier between the guest and host environments and does
103 | not in itself provide the "clean boot" property of a live image.
104 |
105 | - Use a [namespace/cgroups](https://en.wikipedia.org/wiki/Cgroups) jail.
106 | Newer Linux kernels provide a range of other features that can be used to
107 | create container or jail environments. As with chroot, such environments
108 | are difficult to configure securely, although tools such as
109 | [Firejail](https://l3net.wordpress.com/projects/firejail/) can make this
110 | easier. And as with chroot jails, programs running in a namespace jail
111 | can still make system calls directly into the host kernel, and thus are in
112 | a position to exploit kernel-level security flaws.
113 |
114 | - Use a kernel security framework like
115 | [AppArmor](https://en.wikipedia.org/wiki/AppArmor),
116 | [SELinux](https://en.wikipedia.org/wiki/SELinux), or Grsecurity
117 | [RBAC](https://en.wikibooks.org/wiki/Grsecurity/The_RBAC_System) to
118 | restrict the areas of the system that the application can access. These
119 | frameworks serve mainly to prevent a compromised program from affecting
120 | the rest of the system. They are best used along with other exploit
121 | prevention and sandboxing measures.
122 |
123 | ## Architecture
124 |
125 | In this guide we will assume a four-layer architecture that comprises:
126 |
127 | 1. A host system, such as a workstation or laptop
128 | 1. A guest live system, running as a virtual machine on the host system
129 | 1. A container jail environment, running inside the guest system
130 | 1. A Firefox/Iceweasel browser, running inside the jail
131 |
132 | We could consider variations, such as booting and running the live image on
133 | bare metal. In fact, most of this guide concerns setting up the live image
134 | and applies equally well regardless of how and where the live system is run.
135 | One of the advantages of a live image is that it can be carried around on
136 | bootable read-only media and run from any system you happen to have access
137 | to, provided the image was built with the drivers needed to drive the host
138 | hardware.
139 |
140 | A word on virtual machines. A virtual machine can never be more secure than
141 | the host it's running on. Even if your guest operating system and
142 | applications are completely secure, all is lost if the host has been
143 | compromised. The purpose of building a live image sandbox is to protect the
144 | host from the guest and its applications. There is no way to protect the
145 | guest from the host.
146 |
147 | Running applications like web browsers within a virtual machine provides a
148 | relatively high degree of isolation between them and the host. If the
149 | application is compromised, the attacker may gain control over the guest
150 | system, but attacking the host from the guest is a difficult task as long as
151 | basic host security precautions have been taken. Although guest-to-host
152 | exploits that attack the hypervisor interface are
153 | [possible](https://lwn.net/Articles/619376/), such hypervisor flaws are rare
154 | compared to browser flaws and the hypervisor attack surface is much smaller.
155 | The risk can be mitigated further through
156 | [kernel hardening](https://en.wikipedia.org/wiki/PaX) on both the host and
157 | guest systems, and by using a kernel security framework on the host to
158 | restrict the access of hypervisor processes.
159 |
160 | The architecture described in this guide is an example of the principle of
161 | [defense in depth](https://en.wikipedia.org/wiki/Defense_in_depth_(computing)).
162 | Multiple independent security layers are employed simultaneously, each
163 | providing a qualitatively different containment barrier around the
164 | vulnerable application. These security layers are:
165 |
166 | 1. A host system with a kernel hardened using PaX/Grsecurity, and
167 | restriction of hypervisor processes using Grsecurity Role Based Access
168 | Control (RBAC)
169 | 1. A guest system built as a read-only live image with a PaX kernel
170 | 1. A container jail environment inside the guest, created with
171 | [Firejail](https://l3net.wordpress.com/projects/firejail/)
172 | 1. Security-oriented application-level configuration of a Firefox browser,
173 | including default settings and extensions
174 |
175 | ## Layer 1: The Host System
176 |
177 | For our purposes, the only role of the host system is to provide an
178 | environment for building and running a live image. We will assume that the
179 | host is a Linux system and that [KVM](http://linux-kvm.org/) will be used to
180 | run the live image.
181 |
182 | ### Step 1.1: Configure PaX/Grsecurity
183 |
184 | This step is optional, but recommended. Running a Linux kernel patched with
185 | PaX/Grsecurity on the host provides a significantly better security baseline
186 | than vanilla Linux. The Grsecurity RBAC system also provides a way to
187 | restrict the access privileges of hypervisor (QEMU/KVM) processes and other
188 | programs running on the host.
189 |
190 | Setting up Grsecurity requires downloading the Linux kernel
191 | [source](https://www.kernel.org/), applying the
192 | [Grsecurity patch](https://www.grsecurity.net/) that matches the kernel
193 | version, configuring the kernel (including PaX/Grsecurity parameters),
194 | building the kernel, and finally installing and booting it. Assuming
195 | you have downloaded the kernel source as a file with a name like
196 | `linux-x.y.z.tar.xz` and the corresponding Grsecurity
197 | [patch](https://www.grsecurity.net/download.php) as `grsecurity.patch`
198 | (the actual patch filename contains version and date information), the
199 | basic steps are:
200 |
201 | ```
202 | $ tar axf linux-x.y.z.tar.xz
203 | $ cd linux-x.y.z
204 | $ patch -p1 < ../grsecurity.patch
205 | $ make nconfig
206 | [edit and save kernel configuration]
207 | $ make deb-pkg
208 | ```
209 |
210 | If all goes well, this will produce a `linux-image` Debian package file
211 | along with related package files for kernel headers, firmware,
212 | etc. according to Debian kernel-packaging conventions. These `.deb`
213 | files can be installed directly with `dpkg -i`. Another way to build
214 | Debian packages from kernel source is to use
215 | [kernel-package](https://packages.debian.org/kernel-package).
216 |
217 | Refer to the
218 | [Grsecurity documentation](https://en.wikibooks.org/wiki/Grsecurity) for
219 | instructions on applying the Grsecurity patch and configuring the
220 | PaX/Grsecurity kernel settings. When configuring the kernel, try to
221 | eliminate any drivers and features that you don't need on the host system,
222 | and enable other important security options such as
223 | [module signing](https://www.kernel.org/doc/Documentation/module-signing.txt),
224 | [stack protection](https://lwn.net/Articles/584225/), and
225 | [seccomp](https://wiki.mozilla.org/Security/Sandbox/Seccomp). Consult the
226 | Ubuntu
227 | [Kernel Hardening](https://wiki.ubuntu.com/Security/Features#Kernel_Hardening)
228 | feature checklist for other important kernel security features and
229 | parameters.
230 |
231 | ### Step 1.2: Configure the hypervisor
232 |
233 | Ensure QEMU/KVM is installed on the host:
234 |
235 | ```
236 | # apt-get install qemu-kvm
237 | ```
238 |
239 | For QEMU/KVM, hypervisor configuration takes the form of passing a set of
240 | command-line options to `kvm` (which itself is just a wrapper around
241 | `qemu-system-x86_64`). Here is an example script that can be used to boot
242 | an image with some useful QEMU options:
243 |
244 | ```shell
245 | #!/bin/sh
246 |
247 | export QEMU_AUDIO_DRV=alsa
248 |
249 | exec /usr/bin/kvm -cpu host -m 2048 -drive file=$1,if=virtio,media=cdrom \
250 | -balloon virtio \
251 | -usbdevice tablet \
252 | -soundhw hda \
253 | -vga std \
254 | -netdev user,id=network0 -device virtio-net,netdev=network0 \
255 | -virtfs local,path=/tmp/guest_share,mount_tag=share,security_model=mapped-xattr
256 | ```
257 |
258 | To use this script, pass the image you wish to boot as an argument.
259 |
260 | * `-cpu host` tells QEMU to emulate the precise CPU that the host uses,
261 | rather than some different or more generic CPU. This provides the best
262 | performance.
263 | * `-m 2048` allocates 2GB of RAM to the guest (the default is 128MB).
264 | * `-drive file=$1,if=virtio,media=cdrom` says to use the filename passed as
265 | the argument `$1` as the virtual boot drive, to treat it as CDROM media,
266 | and to represent it as a [Virtio](http://www.linux-kvm.org/page/Virtio)
267 | device rather than emulating some form of disk hardware. This requires
268 | Virtio driver support in the guest kernel. Use Virtio interfaces and
269 | drivers whenever possible for best performance and feature support.
270 | * `-balloon virtio` enables
271 | [balloon](http://www.linux-kvm.org/page/Projects/auto-ballooning) support,
272 | allowing the guest to dynamically grow and release memory back to the
273 | host. This requires memory balloon support in the guest kernel.
274 | * `-usbdevice tablet` is necessary to prevent mismatched host/guest mouse
275 | pointers when using VNC.
276 | * `-soundhw hda` instructs QEMU to emulate HDA PCI sound hardware. Combined
277 | with the `export QEMU_AUDIO_DRV=alsa` line, this should provide working
278 | guest-to-host sound. If you don't need sound, you can remove these two
279 | lines. This requires HDA sound driver support in the guest kernel.
280 | * `-vga std` enables high-resolution video mode support.
281 | * `-netdev user,id=network0 -device virtio-net,netdev=network0` enables
282 | basic networking support, placing the guest on a private virtual network
283 | that can access the Internet via the host.
284 | * `-virtfs local,path=/tmp/guest_share,mount_tag=share,security_model=mapped-xattr`
285 | sets up a shared directory between the host and the guest so that files
286 | can easily be moved back and forth. The directory `/tmp/guest_share` on
287 | the host is made accessible to the guest using
288 | [9p](http://www.linux-kvm.org/page/9p_virtio). This requires 9p Virtio
289 | support in the guest kernel.
290 |
291 | You should verify that you can use a script like the above to boot a vanilla
292 | live ISO image on the host. Standard Debian
293 | [live images](http://cdimage.debian.org/debian-cd/current-live/amd64/iso-hybrid/)
294 | are available from the [Live Systems project](http://live-systems.org/).
295 |
296 | To use a VNC display rather than QEMU's default SDL display, you can add an
297 | option like `-vnc 127.0.0.1:0` and use a VNC client to connect to QEMU on
298 | port 5900.
299 |
300 | There is a newer display technology for QEMU called
301 | [SPICE/QXL](http://www.linux-kvm.org/page/SPICE). In theory, this should
302 | provide better graphics capabilities and performance, and also provides a
303 | mechanism for copy/paste clipboard transfer between the guest and host. In
304 | testing on a Linux 3.18 host/guest with QEMU 2.1, however, using QXL led to
305 | guest hangs with the QEMU host process consuming 100% CPU when doing even
306 | basic browsing. To enable SPICE/QXL you can use options like:
307 |
308 | ```
309 | -vga qxl \
310 | -spice addr=127.0.0.1,port=5910,disable-ticketing,image-compression=off
311 | ```
312 |
313 | You will need a [SPICE client](https://packages.debian.org/spice-client) on
314 | the host to connect to the guest display. You will also need to enable QXL
315 | in the guest kernel and install the
316 | [QXL Xorg driver](https://packages.debian.org/xserver-xorg-video-qxl) in the
317 | guest. For copy/paste clipboard support, you will also need the
318 | [spice-vdagent](https://packages.debian.org/spice-vdagent) package in the
319 | guest. See the SPICE documentation for details.
320 |
321 | Another option to consider is `-sandbox on`. This enables
322 | [seccomp](https://wiki.mozilla.org/Security/Sandbox/Seccomp) sandboxing of
323 | the QEMU process. Unfortunately, in testing with Linux 3.18 and QEMU 2.1
324 | this led to instability of QEMU, so use this option with care.
325 |
326 | ### Step 1.3: Secure the Hypervisor
327 |
328 | The purpose of this step is to lock down the access that the hypervisor
329 | process has to the rest of the system. Apart from read/write access to
330 | `/dev/kvm`, QEMU has no special access requirements and can safely be
331 | prevented from reading, writing, or executing most filesystem paths.
332 | Its network access can also be restricted to whatever is required for
333 | the applications you run within the VM.
334 |
335 | The procedure for enforcing access control depends on the security
336 | framework you're using on the host. Most frameworks have a *learning
337 | mode* that allows you to run an application and exercise its
338 | functionality, and that then generates a whitelist policy that permits
339 | access to only those resources actually used by the application during
340 | the learning process. Usually some degree of manual review and tuning
341 | of the generated access policy is needed. Arriving at a good policy
342 | usually requires several tweaks and iterations.
343 |
344 | For example, if you're using the Grsecurity RBAC system and QEMU-x86_64,
345 | you can start with a stub entry in your policy file under the
346 | appropriate user role that looks like this:
347 |
348 | ```
349 | subject /usr/bin/qemu-system-x86_64 lo {
350 | /
351 | }
352 | ```
353 |
354 | The `l` flag places the policy for this program in learning mode. You
355 | can then use `gradm` as usual to enable RBAC in learning mode, exercise
356 | the program, and then generate an initial policy. See the
357 | [RBAC documentation](https://en.wikibooks.org/wiki/Grsecurity/The_RBAC_System)
358 | for details.
359 |
360 | Although Grsecurity RBAC is powerful, it uses a whole-system whitelist
361 | model, meaning that using it requires having a policy that covers all
362 | users and programs on the system. In spite of its 'full system
363 | learning' mode, generating a working full-system poilcy is a difficult
364 | and time-consuming exercise, especially for desktop-oriented systems and
365 | those that depend on invasive multi-function services such as systemd.
366 | A far simpler, though less comprehensive, alternative is
367 | [AppArmor](https://en.wikipedia.org/wiki/AppArmor), which only restricts
368 | programs that have policies defined and has no concept of users or
369 | roles.
370 |
371 | ## Layer 2: The Guest Image
372 |
373 | Now that the host system has been prepared and QEMU is working, we are
374 | ready to configure and build the live image.
375 |
376 | ### Step 2.1: Configuring and Building the Guest Kernel
377 |
378 | Follow the same procedure used to configure and build the
379 | [host kernel](#step-11-configure-paxgrsecurity). When configuring the
380 | guest kernel, note the following points:
381 |
382 | - Remove all hardware drivers except for devices that QEMU can emulate
383 | and that you require. For example, if you want sound support in the
384 | VM, configure the guest kernel to support Intel PCI HDAudio and start
385 | QEMU with the sound options given above. You do not need
386 | hardware-specific drivers for disk, network, or graphics as these will
387 | be handled by Virtio — see below.
388 | - Enable basic virtualization options such as:
389 | * `CONFIG_PARAVIRT`
390 | * `CONFIG_HYPERVISOR_GUEST`
391 | * `CONFIG_KVM_GUEST`
392 | - Many core devices such as block and network devices have optimized
393 | *Virtio* drivers designed specifically for virtual machines. Whenever
394 | possible, use a Virtio driver instead of a hardware driver for a
395 | device that QEMU will have to emulate. Ensure the following options
396 | are enabled:
397 | * `CONFIG_VIRTIO_PCI`
398 | * `CONFIG_VIRTIO_BLK`
399 | * `CONFIG_VIRTIO_NET`
400 | * `CONFIG_HW_RANDOM_VIRTIO`
401 | * `CONFIG_VIRTIO_BALLOON`
402 | - Enable virtualized graphics options:
403 | * `CONFIG_DRM_CIRRUS_QEMU`
404 | * `CONFIG_DRM_QXL`
405 | * `CONFIG_DRM_BOCHS`
406 | - Enable OverlayFS support. This is **required** for a working live
407 | image:
408 | * `CONFIG_OVERLAY_FS`
409 | - If you want to be able to share host directories with the guest to
410 | easily move files back and forth, enable 9p support:
411 | * `CONFIG_NET_9P`
412 | * `CONFIG_NET_9P_VIRTIO`
413 | * `CONFIG_9P_FS`
414 |
415 | ### Step 2.2: Installing the Live-Build Tools on the Host
416 |
417 | The only package you need to build live images is
418 | [live-build](https://packages.debian.org/live-build). Several other
419 | packages such as [live-boot](https://packages.debian.org/live-boot) and
420 | [live-config](https://packages.debian.org/live-config) will be installed
421 | automatically into the live image during the build process. Full
422 | documentation on these packages is available from the
423 | [Live Systems project](http://live-systems.org/).
424 |
425 | To get started with `live-build`, create a directory that will be used
426 | to store your live image configuration and build data (it should have at
427 | least 1 GB of free space available), and then run `lb config` to create
428 | a default live image configuration:
429 |
430 | ```
431 | $ mkdir my_live_image
432 | $ cd my_live_image
433 | $ lb config
434 | [2015-03-02 14:41:16] lb config
435 | P: Creating config tree for a debian/jessie/amd64 system
436 | P: Symlinking hooks...
437 | ```
438 |
439 | This creates a configuration directory tree that live-build uses to
440 | determine how to build the live image. If you don't make any changes to
441 | this tree, you will end up with a default Debian Live image. You should
442 | try to build this default image now to ensure your system is set up
443 | correctly:
444 |
445 | ```
446 | # lb build 2>&1 | tee build.log
447 | ```
448 |
449 | This command will run for some time and generate a lot of output as it
450 | downloads packages, builds the system in a chroot environment, and
451 | finally freezes the chroot tree as a
452 | [squashfs](https://en.wikipedia.org/wiki/SquashFS) image and combines it
453 | with a bootloader and kernel into a bootable binary `.iso` image file.
454 | This final file will be placed in the directory where you ran `lb
455 | build`.
456 |
457 | Note: `lb build` expects to be run as root. If the build system is
458 | running a Grsecurity kernel, you will also have to temporarily
459 | deactivate some Grsecurity chroot restrictions for the build to succeed,
460 | e.g. with
461 |
462 | ```
463 | # echo 0 > /proc/sys/kernel/grsecurity/chroot_caps
464 | # echo 0 > /proc/sys/kernel/grsecurity/chroot_deny_chmod
465 | # echo 0 > /proc/sys/kernel/grsecurity/chroot_deny_mount
466 | # echo 0 > /proc/sys/kernel/grsecurity/chroot_deny_mknod
467 | ```
468 |
469 | #### OverlayFS Support
470 |
471 | Live images require some form of
472 | [Union filesystem](https://en.wikipedia.org/wiki/Union_filesystem)
473 | support in the guest kernel. Traditionally the Debian Live System tools
474 | have used [AuFS](http://aufs.sourceforge.net/) for this. Unfortunately,
475 | AuFS is an out-of-tree kernel patch that does not play nicely with
476 | Grsecurity. There is now an in-tree alternative called OverlayFS,
477 | enabled with the `CONFIG_OVERLAY_FS` option in the guest kernel.
478 | However, at the time of writing, the Debian `live-boot` package does not
479 | properly support OverlayFS. Debian
480 | [bug 773881](https://bugs.debian.org/773881) has been opened for this.
481 | In the bug comments, a link is provided to a Git repository and branch
482 | that contains a patched version of live-boot 5.0a1. Until the official
483 | live-boot package is updated, a working live-boot that supports
484 | OverlayFS can be built from this branch using `dpkg-buildpackage -b`.
485 | This will produce the files `live-boot_5.0~a1-1_all.deb` and
486 | `live-boot-initramfs-tools_5.0~a1-1_all.deb`. These packages should be
487 | placed in the `config/packages.chroot` directory when configuring the
488 | live image (see next step) along with version 5.0a1 of live-config,
489 | overriding the default live-boot and live-config packages that would
490 | otherwise be installed when building the live image.
491 |
492 | ### Step 2.3: Customizing the Live Image
493 |
494 | You have now used `lb build` to successfully build a default Debian Live
495 | ISO image. This image should be bootable and functional on virtual
496 | machines or real hardware. This step covers how to customize the live
497 | image.
498 |
499 | The general procedure for making changes to your live image is to modify
500 | some files in your live configuration tree (the directory where you ran
501 | `lb config`) and then rebuild the live image by running the following
502 | sequence of commands:
503 |
504 | ```
505 | # lb clean
506 | # lb config
507 | # lb build
508 | ```
509 |
510 | The `lb clean` command cleans up data from the last build, the `lb
511 | config` command updates the live image configuration based on your
512 | changes, and the `lb build` command actually builds the new image.
513 |
514 | From now on, we will assume that you are in your live-build root
515 | directory (the directory where you ran `lb config`). Unless otherwise
516 | noted, path names will be given relative to this directory. Most files
517 | and directories used for customization live under the `config/`
518 | subdirectory.
519 |
520 | #### Overview of Live Image Configuration
521 |
522 | See the
523 | [Managing a configuration](http://live-systems.org/manual/current/html/live-manual/managing-a-configuration.en.html)
524 | section of the Live Systems manual for an overview of live image
525 | configuration. Briefly, many basic options, like the target Debian
526 | distribution and architecture, can be specified as options to `lb
527 | config` — see `lb config --help` and `man lb_config` for details.
528 | Passing options to `lb config` results in modifications to one or more
529 | config files located in the `config` subdirectory of your build root.
530 |
531 | Although the manual recommends using auto scripts to manage a live image
532 | configuration, and for good reason, for simplicity we will make changes
533 | by editing configuration files directly. These changes will be
534 | preserved on subsequent runs of `lb config`. Be aware of the caveats of
535 | this approach as described in the manual and consider using auto scripts
536 | instead where possible.
537 |
538 | #### Choosing Packages to Install
539 |
540 | There are two ways to add packages of your choice to your live image.
541 |
542 | ##### Adding standard Debian packages
543 |
544 | For standard Debian packages, create a file with a name ending in
545 | `.list.chroot` in the `config/package-lists` directory. This file may
546 | contain a space-separated list of Debian package names. The named
547 | packages will be retrieved and installed in the chroot during the
548 | build/bootstrap process.
549 |
550 | Here is an example package list for a Firefox/Iceweasel image:
551 |
552 | ```
553 | $ cat config/package-lists/my.list.chroot
554 | task-english pm-utils alsa-utils unzip screen curl iceweasel
555 | spice-vdagent fluxbox attr xserver-xorg-video-modesetting
556 | xserver-xorg-video-qxl xserver-xorg-input-evdev xserver-xorg-input-mouse
557 | xinit x11-apps x11-utils x11-xserver-utils rxvt-unicode
558 | iceweasel-noscript iceweasel-perspectives iceweasel-refcontrol
559 | iceweasel-requestpolicy iceweasel-openinbrowser
560 | iceweasel-https-everywhere
561 | ```
562 |
563 | Remarks on some of these packages:
564 |
565 | - `attr` is required to set PaX flags on executables, assuming the
566 | `CONFIG_PAX_XATTR_PAX_FLAGS` kernel option was chosen (recommended).
567 | - `pm-utils` is included for `pm-suspend` which can be used to put the
568 | system to sleep temporarily. Sometimes suspending the VM is
569 | necessary before suspending the host to avoid a frozen VM when the
570 | host resumes.
571 | - `alsa-utils` is included for basic sound utilities such as
572 | `alsamixer`.
573 | - `spice-vdagent` is required for copy/paste support via QEMU SPICE,
574 | discussed earlier.
575 | - `fluxbox` is a lightweight window manager for X. You can choose any
576 | other window manager or desktop environment you like.
577 | - The `xserver-xorg` packages select X drivers important for QEMU,
578 | corresponding to the kernel drivers selected earlier.
579 | - The `iceweasel-*` packages select some useful Firefox extensions that
580 | happen to be packaged for Debian. We will look at other ways to
581 | customize extensions later.
582 |
583 | ##### Adding custom packages (including the guest kernel)
584 |
585 | For packages in the form of `.deb` files that are not part of your
586 | chosen Debian distribution (or that you want to override those in the
587 | distribution), simply place the files in the `config/packages.chroot`
588 | directory. This is how we provide the guest kernel package we built
589 | earlier. For example:
590 |
591 | ```
592 | $ ls config/packages.chroot
593 | firejail_0.9.22_1_amd64.deb
594 | linux-image-3.19.1-grsec1_3.19.1-grsec1-1_amd64.deb
595 | live-boot_5.0~a1-1_all.deb
596 | live-boot-initramfs-tools_5.0~a1-1_all.deb
597 | live-config_5.0~a1-1_all.deb
598 | live-config-systemd_5.0~a1-1_all.deb
599 | ```
600 |
601 | - A [Firejail](https://l3net.wordpress.com/projects/firejail/) package
602 | is included since it is not yet part of Debian.
603 | - The `linux-image` package is the guest kernel built earlier.
604 | - The `live-boot` packages are included here if they were custom-built
605 | for OverlayFS support as discussed earlier.
606 | - The `live-config` packages are included here from `experimental` so
607 | that they match the `live-boot` package versions.
608 |
609 | #### Enabling OverlayFS
610 |
611 | In order to use OverlayFS, you must edit the file `config/chroot` and
612 | change
613 |
614 | ```
615 | LB_UNION_FILESYSTEM="aufs"
616 | ```
617 |
618 | to
619 |
620 | ```
621 | LB_UNION_FILESYSTEM="overlay"
622 | ```
623 |
624 | You must also pass a boot parameter to the kernel; see below.
625 |
626 | #### Customizing Kernel Boot Parameters
627 |
628 | In some cases it is necessary to modify the boot parameters passed to
629 | the live image kernel. This is done by modifying the
630 | `LB_BOOTAPPEND_LIVE` option in `config/binary`, which defaults to:
631 |
632 | ```
633 | LB_BOOTAPPEND_LIVE="boot=live components quiet splash"
634 | ```
635 |
636 | Adding `union=overlay` is **required** for OverlayFS to work:
637 |
638 | ```
639 | LB_BOOTAPPEND_LIVE="boot=live components quiet splash union=overlay"
640 | ```
641 |
642 | Many runtime live image configuration options can also be passed in the
643 | form of kernel options; see
644 | [man live-config](http://live-systems.org/manpages/4.x/en/html/live-config.7.html)
645 | for details.
646 |
647 | #### Custom Build Hooks
648 |
649 | Executable scripts can be placed in the `config/hooks` directory. Their
650 | filenames should end with `.hook.chroot`. These scripts will be run
651 | inside the chroot at the end of the build process, and can be used to
652 | make changes to the live system before it is frozen into the final
653 | image.
654 |
655 | For example, this mechanism can be used to set a root password. Create
656 | an executable file called `config/hooks/0500-root-password.hook.chroot`
657 | containing:
658 |
659 | ```shell
660 | #!/bin/sh
661 | usermod -p '$5$GxpbCxvGOmtudd$uL90C.ZOMY6WxI4.x32kTCv38dGiXYUlfWGzCQuHmr3' root
662 | ```
663 |
664 | Replace the argument to the `-p` option with the output of `mkpasswd`
665 | (available as part of the [whois](https://packages.debian.org/whois)
666 | package). See `man mkpasswd`.
667 |
668 | #### Customizing Live Image Contents
669 |
670 | The directory `config/includes.chroot` represents the `/` directory of
671 | the live image filesystem. Files placed here will be added directly to
672 | the final live image, replacing existing ones if necessary.
673 |
674 | For example, to add some custom 'dotfiles' to the live user's home
675 | directory, put them in `config/includes.chroot/etc/skel`. They will
676 | then end up in `/etc/skel` on the live system and will be copied to the
677 | live user's home directory when it is created during system startup.
678 |
679 | #### Custom Runtime Hooks
680 |
681 | Whereas build hooks are run during the live image build process, runtime
682 | hooks are run inside the live system during boot. These hooks are
683 | processed by `live-config`. To add a runtime hook, place an executable
684 | script in `config/includes.chroot/lib/live/config`. You should examine
685 | the default hooks (found in `chroot/lib/live/config` after an `lb
686 | build`) or the live-config examples in
687 | `/usr/share/doc/live-config/examples/hooks`.
688 |
689 | ### Step 2.4: Specific Customizations
690 |
691 | #### Root Access
692 |
693 | By default, the live system has one user named `user` with password
694 | `live`. This user can execute commands as root with `sudo` without
695 | specifying a password. A better configuration is to disable sudo and
696 | set a root password. We saw how to set a root password with a
697 | [Custom Build Hook](#custom-build-hooks) above. To disable sudo, add
698 | `live-config.noroot` to the kernel boot parameters list
699 | (`LB_BOOTAPPEND_LIVE` in `config/binary`).
700 |
701 | #### PaX Flags and Iceweasel
702 |
703 | If your guest kernel is configured for PaX and the process memory
704 | protection feature (`CONFIG_PAX_MPROTECT`) is enabled by default
705 | (recommended), then you will not be able to run Iceweasel without
706 | disabling memory protection on the `iceweasel` and `plugin-container`
707 | binaries in `/usr/lib/iceweasel`. (This suboptimal situation arises
708 | because Firefox uses JIT compilation for performance, which by its
709 | nature depends on memory regions that are both writable and executable.
710 | It is possible to compile Firefox without JIT, but this is not done for
711 | the standard Debian packages.) This can be done with a
712 | [runtime hook](#custom-runtime-hooks). For example, you can place an
713 | executable script like the following in
714 | `config/includes.chroot/lib/live/config/1200-setattr`:
715 |
716 | ```shell
717 | #!/bin/sh
718 |
719 | Init ()
720 | {
721 | echo -n " setattr"
722 | }
723 |
724 | Config ()
725 | {
726 | if [ -f /usr/bin/iceweasel -a -f /usr/bin/setfattr ]; then
727 | setfattr -n user.pax.flags -v m /usr/bin/iceweasel
728 | setfattr -n user.pax.flags -v m /usr/lib/iceweasel/plugin-container
729 | fi
730 |
731 | # Creating state file
732 | touch /var/lib/live/config/setattr
733 | }
734 |
735 | Init
736 | Config
737 | ```
738 |
739 | The `setfattr` method only applies if you selected the
740 | `CONFIG_PAX_XATTR_PAX_FLAGS` option when configuring the guest kernel
741 | (recommended).
742 |
743 | #### Default X Resolution
744 |
745 | The X resolution can be changed at runtime with `xrandr`. To change the
746 | default resolution, add a
747 | [kernel boot parameter](#customizing-kernel-boot-parameters) like
748 | `live-config.xorg-resolution=1600x1200`. See
749 | [man live-config](http://live-systems.org/manpages/4.x/en/html/live-config.7.html)
750 | for details and other options.
751 |
752 | #### Mount a Host Directory with [9p](https://www.kernel.org/doc/Documentation/filesystems/9p.txt)
753 |
754 | If you configured QEMU to share a host directory via 9p and you included
755 | 9p support in your guest kernel, you may want to mount the share
756 | automatically at boot. There are many ways to do this, but a quick hack
757 | that works is to create `config/includes.chroot/etc/rc.local` as an
758 | executable shell script and add a line like:
759 |
760 | ```
761 | mount -t 9p -o trans=virtio,version=9p2000.L share /mnt
762 | ```
763 |
764 | Here `share` is a tag that must match the tag you passed to QEMU via the
765 | `-virtfs` option.
766 |
767 | Be warned that 9p support can exhibit some instabilities. In testing
768 | with Linux 3.18 and QEMU 2.1, passing `-sandbox on` caused writes to
769 | files over 9p to hang the writing process unrecoverably. Even without
770 | `-sandbox on`, creation of files over 9p fails with 'Operation not
771 | supported' (but writing to existing files works). This can be worked
772 | around by creating the file on the host before trying to write to it
773 | from the guest.
774 |
775 | Unrecoverable hangs on the guest may also arise with 9p following
776 | suspend/resume. To work around this, unload the 9p kernel modules
777 | (`9p`, `9pnet`, `9pnet_virtio`) using `modprobe -r` before suspend.
778 |
779 | ## Layer 3: Firejail
780 |
781 | [Firejail](https://l3net.wordpress.com/projects/firejail/) can
782 | optionally be used to provide another sandbox layer inside the live
783 | system. Firejail runs a program inside a 'container' environment that
784 | provides kernel namespace and filesystem isolation, as well as
785 | [seccomp](https://wiki.mozilla.org/Security/Sandbox/Seccomp) system call
786 | restriction. It is easy to use, supports a number of useful features
787 | and options, and can be used to sandbox any program.
788 |
789 | To install Firejail, simply download the `.deb` file from the Firejail
790 | project page (it is not yet available in the Debian repositories) and
791 | place it in `config/packages.chroot`.
792 |
793 | To run Firefox/Iceweasel with Firejail, run a command like:
794 |
795 | ```
796 | $ firejail --debug iceweasel
797 | ```
798 |
799 | The `--debug` option causes Firejail to produce verbose messages about
800 | what it's doing. Another useful mode is:
801 |
802 | ```
803 | $ mkdir ~/sandbox
804 | $ firejail --debug --private=$HOME/sandbox iceweasel
805 | ```
806 |
807 | The `--private` option starts the program in a clean home directory,
808 | preventing access to the user's real home directory. This is a good way
809 | to start a 'known clean' browser instance.
810 |
811 | ### Restricting Filesystem Access
812 |
813 | Firejail uses a blacklist method for restricting access to parts of
814 | filesystem. It achieves this by remounting system directories like
815 | `/etc`, `/lib`, and `/usr` as read-only within the container by default,
816 | and fully blocking access to some files and directories by mounting an
817 | empty tmpfs filesystem on top of them. (Seccomp filtering prevents
818 | these mounts from being changed within the container with calls to
819 | mount(2).)
820 |
821 | One omission in the defaults is that they leave the `/dev` directory
822 | accessible. This can be fixed by, for example, creating a file called
823 | `/etc/firejail/blacklist-dev.inc` with contents like:
824 | ```
825 | seccomp mknod
826 |
827 | blacklist /dev/autofs
828 | blacklist /dev/block
829 | ...
830 | ```
831 |
832 | The `seccomp mknod` line instructs Firejail to prevent the use of
833 | mknod(2) within the container so that new device files can't be created
834 | (the default in recent versions). To prevent access to the pre-existing
835 | device files in `/dev`, each file or subdirectory of `/dev` must be
836 | listed on a separate `blacklist` line. It is safe (and recommended) to
837 | blacklist nearly all device files (other than e.g. `/dev/null` and
838 | `/dev/urandom`) when running Firefox/Iceweasel.
839 |
840 | To use this file, add a line like
841 |
842 | ```
843 | include /etc/firejail/blacklist-dev.inc
844 | ```
845 |
846 | to `/etc/firejail/firefox.profile` or any other profile in `/etc/firejail`.
847 |
848 | ## Layer 4: Firefox/Iceweasel Customization
849 |
850 | If you are building a Firefox live image, you will want to customize
851 | things like the browser version, preferences, and extensions.
852 |
853 | ### Customizing the Browser Version
854 |
855 | If you want to install a version of Iceweasel other than the one in your
856 | target live image distribution, you will most likely have to resort to
857 | [APT pinning](https://wiki.debian.org/AptPreferences). For instance,
858 | you may want to install the latest Firefox release version, which is
859 | usually available in Debian `experimental`. You can do this by placing
860 | a couple of files in the `config/archives` directory.
861 |
862 | The `experimental.list.chroot` file:
863 |
864 | ```
865 | deb http://ftp.debian.org/debian unstable main
866 | deb http://ftp.debian.org/debian experimental main
867 | ```
868 |
869 | The `experimental.pref.chroot` file:
870 |
871 | ```
872 | Package: iceweasel
873 | Pin: release a=experimental
874 | Pin-Priority: 995
875 |
876 | Package: *
877 | Pin: release a=unstable
878 | Pin-Priority: 1
879 | ```
880 |
881 | This configuration directs APT to install the `iceweasel` package from
882 | `experimental` and to meet dependencies from `unstable` when they cannot
883 | be met from the target distribution.
884 |
885 | ### Customizing Preferences
886 |
887 | Most preferences are customized by placing files in
888 | `config/includes.chroot/etc/iceweasel/profile`. When a user first
889 | launches Iceweasel, it creates a profile directory in
890 | `~/.mozilla/firefox` based on the contents of `/etc/iceweasel/profile`.
891 |
892 | Some files and directories that are useful for customization:
893 |
894 | - `prefs.js` is the main browser settings and preferences file.
895 | - `bookmarks.html` is the default bookmarks list.
896 | - `extension-data` is a directory that some extensions use to store
897 | local data.
898 | - `searchplugins` is the directory where different search engines are
899 | defined. Each has a single `.xml` file in this directory.
900 | - `search-metadata.json` contains user preferences related to search
901 | engines.
902 |
903 | You can easily customize your live image browser by copying files like
904 | those above from the profile directory of an already-customized Firefox
905 | installation into `config/includes.chroot/etc/iceweasel/profile`.
906 |
907 | ### Default Preferences for Security and Privacy
908 |
909 | Many of the default Firefox settings are suboptimal for security and
910 | privacy. By way of example, this section provides a better set of
911 | defaults that can be included in your `prefs.js` file. You should
912 | understand what each setting does before using it — see the
913 | Mozilla [documentation](http://kb.mozillazine.org/About:config_entries)
914 | for details.
915 |
916 | ```javascript
917 | /* Don't start finding text when any input is typed */
918 | user_pref("accessibility.typeaheadfind.autostart", false);
919 |
920 | /* Start with a simple blank page */
921 | user_pref("browser.startup.page", 1);
922 | user_pref("browser.startup.homepage", "about:about");
923 |
924 | /* Don't send every URL we visit to Google */
925 | user_pref("browser.safebrowsing.enabled", false);
926 | user_pref("browser.safebrowsing.malware.enabled", false);
927 |
928 | /* Don't save information entered in web forms and search bars */
929 | user_pref("browser.formfill.enable", false);
930 |
931 | /* Backspace goes back one page in history */
932 | user_pref("browser.backspace_action", 0);
933 |
934 | /* Ask where to save downloads */
935 | user_pref("browser.download.useDownloadDir", false);
936 |
937 | /* When JavaScript wants to open a new window, open a tab instead */
938 | user_pref("browser.link.open_newwindow.restriction", 0);
939 |
940 | /* Always use Private Browsing Mode */
941 | user_pref("browser.privatebrowsing.autostart", true);
942 |
943 | /* Disable search suggestions */
944 | user_pref("browser.search.suggest.enabled", false);
945 |
946 | /* Limit state information saved between sessions */
947 | user_pref("browser.sessionstore.max_tabs_undo", 5);
948 | user_pref("browser.sessionstore.resume_from_crash", false);
949 |
950 | /* Turn off tab animations */
951 | user_pref("browser.tabs.animate", false);
952 |
953 | /* Turn off URL bar funny business */
954 | user_pref("browser.urlbar.autocomplete.enabled", false);
955 | user_pref("browser.urlbar.trimURLs", false);
956 |
957 | /* Disallow JavaScript access to potentially dangerous APIs */
958 | user_pref("dom.event.clipboardevents.enabled", false);
959 | user_pref("dom.battery.enabled", false);
960 | user_pref("dom.disable_window_open_feature.menubar", true);
961 | user_pref("dom.disable_window_open_feature.personalbar", true);
962 | user_pref("dom.disable_window_open_feature.scrollbars", true);
963 | user_pref("dom.disable_window_open_feature.toolbar", true);
964 | user_pref("dom.popup_maximum", 10);
965 | user_pref("dom.storage.default_quota", 0);
966 |
967 | /* Override User-Agent data to mitigate browser fingerprinting.
968 | * See https://panopticlick.eff.org/
969 | */
970 | user_pref("general.appname.override", "Netscape");
971 | user_pref("general.appversion.override", "5.0 (Windows)");
972 | user_pref("general.buildID.override", 0);
973 | user_pref("general.oscpu.override", "Windows NT 6.2");
974 | user_pref("general.platform.override", "Win32");
975 | user_pref("general.productSub.override", "20100101");
976 | user_pref("general.useragent.override", "Mozilla/5.0 (Windows NT 6.2; rv:36.0) Gecko/20100101 Firefox/36.0");
977 | user_pref("general.useragent.vendor", "");
978 | user_pref("general.useragent.vendorSub", "");
979 | user_pref("general.warnOnAboutConfig", false);
980 | user_pref("intl.accept_languages", "en-us,en;q=0.5");
981 |
982 | /* Turn off "location aware browsing" */
983 | user_pref("geo.enabled", false);
984 |
985 | /* Turn off sending non-URL words entered in the URL bar to Google */
986 | user_pref("keyword.enabled", false);
987 |
988 | /* Turn off spell-checking */
989 | user_pref("layout.spellcheckDefault", 0);
990 |
991 | /* Disable cookies by default. Use an extension for site-specific
992 | * whitelisting.
993 | */
994 | user_pref("network.cookie.cookieBehavior", 2);
995 | user_pref("network.cookie.thirdparty.sessionOnly", true);
996 |
997 | /* Disable IPv6 unless you want to use it. */
998 | user_pref("network.dns.disableIPv6", true);
999 |
1000 | /* Don't "proactively" perform DNS resolution */
1001 | user_pref("network.dns.disablePrefetch", true);
1002 |
1003 | /* Unneeded unless we're using v6 */
1004 | user_pref("network.http.fast-fallback-to-IPv4", false);
1005 |
1006 | /* Enable pipelining for better performance */
1007 | user_pref("network.http.pipelining", true);
1008 | user_pref("network.http.pipelining.maxrequests", 15);
1009 | user_pref("network.http.pipelining.ssl", true);
1010 | user_pref("network.http.proxy.pipelining", true);
1011 | user_pref("network.http.redirection-limit", 5);
1012 |
1013 | /* Don't "proactively" fetch pages that haven't been requested */
1014 | user_pref("network.prefetch-next", false);
1015 |
1016 | /* Disable Websockets by default */
1017 | user_pref("network.websocket.enabled", false);
1018 |
1019 | /* Enable the Do-Not-Track header in HTTP requests */
1020 | user_pref("privacy.donottrackheader.enabled", true);
1021 |
1022 | /* Clear Private Data when closing the browser */
1023 | user_pref("privacy.sanitize.sanitizeOnShutdown", true);
1024 |
1025 | /* Disable unsafe RC4 ciphers */
1026 | user_pref("security.ssl3.ecdhe_ecdsa_rc4_128_sha", false);
1027 | user_pref("security.ssl3.ecdhe_rsa_rc4_128_sha", false);
1028 | user_pref("security.ssl3.rsa_rc4_128_md5", false);
1029 | user_pref("security.ssl3.rsa_rc4_128_sha", false);
1030 |
1031 | /* Disable WebGL by default */
1032 | user_pref("webgl.disabled", true);
1033 | ```
1034 |
1035 | ### Customizing Extensions
1036 |
1037 | If the extension you want to add to your live image is already packaged
1038 | for Debian (for example, `iceweasel-noscript`), you can install it as
1039 | you would any other package by including its name in a file in
1040 | `config/package-lists`.
1041 |
1042 | Otherwise, you will have to place either the packed or unpacked
1043 | extension in the following directory:
1044 |
1045 | ```
1046 | config/includes.chroot/usr/share/mozilla/extensions/{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
1047 | ```
1048 |
1049 | However, the packed extension (`.xpi`) file or unpacked directory must
1050 | have a specific name. To find this name, unpack the `install.rdf` file
1051 | and inspect it:
1052 |
1053 | ```
1054 | $ unzip extension.xpi install.rdf
1055 | ```
1056 |
1057 | Near the top of this file there will be an `` or `` tag that
1058 | looks similar to
1059 |
1060 | ```
1061 | {2b10c1c8-a11f-4bad-fe9c-1c11e82cac42}
1062 | ```
1063 |
1064 | or
1065 |
1066 | ```
1067 | https-everywhere@eff.org
1068 | ```
1069 |
1070 | To install an extension as a packed file, place it in the above
1071 | directory with the name `${XID}.xpi`, where `${XID}` is the content of
1072 | the `` or `` tag in the extension's `install.rdf` file.
1073 |
1074 | To install an extension as an unpacked directory, create a subdirectory
1075 | in the above directory whose name is `${XID}`, then place the unzipped
1076 | contents of the `.xpi` file in that directory.
1077 |
1078 |
--------------------------------------------------------------------------------