Firefox and attachments

[Mako_Elite]

Hello there,
I am trying to attach text document in forums here in Daemonforums using Attachment manager using Firefox
and there isno option to get to my home folder. Only option is computer, when I click on it, it disappear . Almost like Firefox has no permissions to file system.
But my Thunderbird email client works just fine I can attach files with no issues.
I searched everywhere to fix this.
Any help with this is greatly appreciated.

thank you

Ludovit

[TronDD]

Originally Posted by Mako_Elite

Almost like Firefox has no permissions to file system.

Yes, exactly. Firefox is using unveil(2) and by default can only access $HOME/Downloads and /tmp.

Readthe Firefox pkg-readme
/usr/local/share/doc/pkg-readmes/firefox

[Mako_Elite]

Thanks for the info. Firefox is nicely locked down .
Interesting there was no folder available to download or upload. /etc/firefox/unveil.main has ~/Downloads set -r.
After installing Chromium same folder in /etc/firefox/unveil.main ~/Downloads was changed to rwc.
Now I can see Downloads folder option in Attachments Manager in Firefox.

Something during installing Chromium changed permissions in unveil.main to rwc in Firefox.
Chromium has same permissions.

[bradley]

That's surely a good thing that Firefox is nicely locked down.

However it is making so many connections after a simple startup. First I was suspecting some add-ons, but even after turning off all the extensions there seem to be many built in Firefox services. In this respect Otter is a true champion. Browser started - there is no single connection that the browser would make on its own.

[fvgit]

You can check where most of these built in Firefox services phone home to if you open about:config and enter the word url in the search bar. I have crippled most of these by prepending an underscore taming the whole flea circus somewhat.

_https... etc.

[victorvas]

Is this good for Firefox?
https://github.com/ghacksuserjs/ghacks-user.js/wiki

Is this correct?
https://spyware.neocities.org/articles/firefox.html

[bradley]

^Yes, that's all correct on that spyware.neocities site, which provides great analysis for other browsers too.

I detected those Firefox connections to google and amazon servers as well (overview on about:networking, good to check the IPs with whois). They use those servers for different services (like described on neocities or push notifications, etc). Not sure about the hardening steps but I'd like to get rid of those connections too.