Request to compile Firefox with -fpie and -pie options to fully support ASLR

[LinuxSpring1]

@siamhie I have raised the issue in the Firefox Forum. Once I get access to the Mozilla BugZilla I will raise a bug too. If that does not solve the issue then I will look at LibreWolf. I am torn between two options over here. Vivaldi or LibreWolf. Have you used any of these?

[richb]

I have been using Vivaldi for well over a year. It has multiple features and has been very solid. Frequently updates with new features. Security updates are also done.

[siamhie]

@siamhie I have raised the issue in the Firefox Forum. Once I get access to the Mozilla BugZilla I will raise a bug too. If that does not solve the issue then I will look at LibreWolf. I am torn between two options over here. Vivaldi or LibreWolf. Have you used any of these?

I've been using LibreWolf ever since version 94. It's kind of like FF with the hardened scripts you can find on GitHub.
I have tried Vivaldi in the past but I'm not a fan of Google. I'm basically a Mozilla fanboy ever since Navigator Gold. (I sure do miss that animated icon when web pages were loading)
I've even switched from using Google's search engine to DDG (duckduckgo) and the DNS servers on my router from Google to Cloudflare.

[kmathern]

If you look in the /opt/firefox folder there's also a firefox-bin executable

Code: Select all

$ ls -l /opt/firefox/firefox*
-rwxr-xr-x 1 root root   5432 Sep 16 11:12 /opt/firefox/firefox
-rwxr-xr-x 1 root root 986240 Sep 16 11:12 /opt/firefox/firefox-bin
-rw-r--r-- 1 root root   1449 Sep 16 11:12 /opt/firefox/firefox-bin.sig
-rw-r--r-- 1 root root   1449 Sep 16 11:12 /opt/firefox/firefox.sig

Other than the launcher command 'firefox' (/usr/bin/firefox symlinked to /opt/firefox/firefox) the firefox processes I see all
show /opt/firefox/firefox-bin

Code: Select all

$ ps aux | grep firefox | sed '$ d'
kent       56098  0.4  3.2 3853460 529820 ?      Sl   Sep17   3:51 firefox
kent       56167  0.0  0.1 215068 31856 ?        Sl   Sep17   0:00 /opt/firefox/firefox-bin -contentproc -parentBuildID 20240913135723 -prefsLen 46901 -prefMapSize 278527 -appDir /opt/firefox/browser {04ffee41-5427-47e3-adb3-814bd29c89a3} 56098 true socket
kent       56183  0.0  0.8 2487568 143220 ?      Sl   Sep17   0:02 /opt/firefox/firefox-bin -contentproc -childID 1 -isForBrowser -prefsLen 47042 -prefMapSize 278527 -jsInitLen 234840 -parentBuildID 20240913135723 -greomni /opt/firefox/omni.ja -appomni /opt/firefox/browser/omni.ja -appDir /opt/firefox/browser {ecd88a31-15a8-4f94-8a0e-6cb56b522dd0} 56098 true tab
kent       56247  0.0  2.5 19928732 409184 ?     Sl   Sep17   0:31 /opt/firefox/firefox-bin -contentproc -childID 2 -isForBrowser -prefsLen 53337 -prefMapSize 278527 -jsInitLen 234840 -parentBuildID 20240913135723 -greomni /opt/firefox/omni.ja -appomni /opt/firefox/browser/omni.ja -appDir /opt/firefox/browser {be978a92-fd25-46ac-baf8-2ba248a5c82f} 56098 true tab
kent       56306  0.0  0.2 380812 48100 ?        Sl   Sep17   0:02 /opt/firefox/firefox-bin -contentproc -parentBuildID 20240913135723 -sandboxingKind 0 -prefsLen 53434 -prefMapSize 278527 -appDir /opt/firefox/browser {f39d0e7a-5650-43a3-8b93-2c88bf9bfa0c} 56098 true utility
kent       56315  0.2  1.2 2573256 195444 ?      Sl   Sep17   1:57 /opt/firefox/firefox-bin -contentproc -childID 3 -isForBrowser -prefsLen 39246 -prefMapSize 278527 -jsInitLen 234840 -parentBuildID 20240913135723 -greomni /opt/firefox/omni.ja -appomni /opt/firefox/browser/omni.ja -appDir /opt/firefox/browser {e15cda9c-3dcd-46d1-946f-78f93d3dfbf8} 56098 true tab
kent       56333  0.0  1.2 2559200 197656 ?      Sl   Sep17   0:04 /opt/firefox/firefox-bin -contentproc -childID 5 -isForBrowser -prefsLen 39246 -prefMapSize 278527 -jsInitLen 234840 -parentBuildID 20240913135723 -greomni /opt/firefox/omni.ja -appomni /opt/firefox/browser/omni.ja -appDir /opt/firefox/browser {c0a14ae9-d90b-4ca2-987b-cc61e7894746} 56098 true tab
kent       57630  0.0  2.1 2836080 343860 ?      Sl   Sep17   0:19 /opt/firefox/firefox-bin -contentproc -childID 7 -isForBrowser -prefsLen 39299 -prefMapSize 278527 -jsInitLen 234840 -parentBuildID 20240913135723 -greomni /opt/firefox/omni.ja -appomni /opt/firefox/browser/omni.ja -appDir /opt/firefox/browser {87ec3a5f-5c8d-400f-9ffe-ddb8202022dc} 56098 true tab
kent       59242  1.8  2.5 2843392 416660 ?      Sl   08:49   1:53 /opt/firefox/firefox-bin -contentproc -childID 9 -isForBrowser -prefsLen 39404 -prefMapSize 278527 -jsInitLen 234840 -parentBuildID 20240913135723 -greomni /opt/firefox/omni.ja -appomni /opt/firefox/browser/omni.ja -appDir /opt/firefox/browser {2abb31fd-7026-40db-a8ae-71497c77f3d9} 56098 true tab
kent       60153  0.1  0.6 610328 105056 ?       Sl   09:30   0:05 /opt/firefox/firefox-bin -contentproc -parentBuildID 20240913135723 -prefsLen 53666 -prefMapSize 278527 -appDir /opt/firefox/browser {a14ab8b9-b315-479d-ad27-a2168b0ab5b4} 56098 true rdd
kent       61261  0.2  1.2 2603024 209476 ?      Sl   09:44   0:08 /opt/firefox/firefox-bin -contentproc -childID 16 -isForBrowser -prefsLen 39404 -prefMapSize 278527 -jsInitLen 234840 -parentBuildID 20240913135723 -greomni /opt/firefox/omni.ja -appomni /opt/firefox/browser/omni.ja -appDir /opt/firefox/browser {a3c017f8-bf86-4b38-94fb-d4f98f22209a} 56098 true tab
kent       63370  0.0  0.4 2433392 78728 ?       Sl   09:52   0:00 /opt/firefox/firefox-bin -contentproc -childID 21 -isForBrowser -prefsLen 40608 -prefMapSize 278527 -jsInitLen 234840 -parentBuildID 20240913135723 -greomni /opt/firefox/omni.ja -appomni /opt/firefox/browser/omni.ja -appDir /opt/firefox/browser {08bef2de-142a-4c7f-b934-3283a0eaace8} 56098 true tab
kent       63424  0.1  0.9 2546592 157024 ?      Sl   09:53   0:03 /opt/firefox/firefox-bin -contentproc -childID 22 -isForBrowser -prefsLen 54870 -prefMapSize 278527 -jsInitLen 234840 -parentBuildID 20240913135723 -greomni /opt/firefox/omni.ja -appomni /opt/firefox/browser/omni.ja -appDir /opt/firefox/browser {05efb9e1-5730-45bf-af8e-a31aaa231ca7} 56098 true tab
kent       63915  0.0  0.3 2415356 57316 ?       Sl   09:58   0:00 /opt/firefox/firefox-bin -contentproc -childID 23 -isForBrowser -prefsLen 40608 -prefMapSize 278527 -jsInitLen 234840 -parentBuildID 20240913135723 -greomni /opt/firefox/omni.ja -appomni /opt/firefox/browser/omni.ja -appDir /opt/firefox/browser {ccf73f71-641e-4ac4-a463-98c130b9336e} 56098 true tab
kent       64071  0.0  0.3 2415372 57920 ?       Sl   10:02   0:00 /opt/firefox/firefox-bin -contentproc -childID 24 -isForBrowser -prefsLen 40608 -prefMapSize 278527 -jsInitLen 234840 -parentBuildID 20240913135723 -greomni /opt/firefox/omni.ja -appomni /opt/firefox/browser/omni.ja -appDir /opt/firefox/browser {1b08468c-1b98-4b26-9eb4-353e798c7d6d} 56098 true tab
kent       65216  0.1  0.3 2415112 57284 ?       Sl   10:31   0:00 /opt/firefox/firefox-bin -contentproc -childID 25 -isForBrowser -prefsLen 40608 -prefMapSize 278527 -jsInitLen 234840 -parentBuildID 20240913135723 -greomni /opt/firefox/omni.ja -appomni /opt/firefox/browser/omni.ja -appDir /opt/firefox/browser {750895ad-92c4-4cc6-975f-8abb750c62c5} 56098 true tab

/opt/firefox/firefox-bin is a DYN Position-Independent Executable file

Code: Select all

$ readelf -h /opt/firefox/firefox-bin
ELF Header:
  Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 
  Class:                             ELF64
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              DYN (Position-Independent Executable file)
  Machine:                           Advanced Micro Devices X86-64
  Version:                           0x1
  Entry point address:               0xb3b1e
  Start of program headers:          64 (bytes into file)
  Start of section headers:          984256 (bytes into file)
  Flags:                             0x0
  Size of this header:               64 (bytes)
  Size of program headers:           56 (bytes)
  Number of program headers:         12
  Size of section headers:           64 (bytes)
  Number of section headers:         31
  Section header string table index: 30

[dolphin_oracle]

thanks kent. makes sense that mozilla would already be doing this.

[LinuxSpring1]

I have been using Vivaldi for well over a year. It has multiple features and has been very solid. Frequently updates with new features. Security updates are also done.

Thanks @richb

@siamhie I have raised the issue in the Firefox Forum. Once I get access to the Mozilla BugZilla I will raise a bug too. If that does not solve the issue then I will look at LibreWolf. I am torn between two options over here. Vivaldi or LibreWolf. Have you used any of these?

I've been using LibreWolf ever since version 94. It's kind of like FF with the hardened scripts you can find on GitHub.
I have tried Vivaldi in the past but I'm not a fan of Google. I'm basically a Mozilla fanboy ever since Navigator Gold. (I sure do miss that animated icon when web pages were loading)
I've even switched from using Google's search engine to DDG (duckduckgo) and the DNS servers on my router from Google to Cloudflare.

@siamhie thanks for your inputs on LibreWolf. If I am not mistaken Vivaldi has removed from the chromium source code all the references and call backs to Google servers. Further after Opera was sold to an East Asian controlling interests a few people split off from Opera and founded Vivaldi. It may be the best of the world, chromiums and V8's power minus all the insidious tracking.
About LibreWolf, while using it have you come across broken websites and functionality that does not work? My only concern with LibreWolf is that it is supported by a small handful of volunteers. They do not have a structure in place like Mozilla. Nor the financial heft. If they were to scatter then LibreWolf would become defunct.

If you look in the /opt/firefox folder there's also a firefox-bin executable

Code: Select all

$ ls -l /opt/firefox/firefox*
-rwxr-xr-x 1 root root   5432 Sep 16 11:12 /opt/firefox/firefox
-rwxr-xr-x 1 root root 986240 Sep 16 11:12 /opt/firefox/firefox-bin
-rw-r--r-- 1 root root   1449 Sep 16 11:12 /opt/firefox/firefox-bin.sig
-rw-r--r-- 1 root root   1449 Sep 16 11:12 /opt/firefox/firefox.sig

Other than the launcher command 'firefox' (/usr/bin/firefox symlinked to /opt/firefox/firefox) the firefox processes I see all
show /opt/firefox/firefox-bin

Code: Select all

$ ps aux | grep firefox | sed '$ d'
kent       56098  0.4  3.2 3853460 529820 ?      Sl   Sep17   3:51 firefox
kent       56167  0.0  0.1 215068 31856 ?        Sl   Sep17   0:00 /opt/firefox/firefox-bin -contentproc -parentBuildID 20240913135723 -prefsLen 46901 -prefMapSize 278527 -appDir /opt/firefox/browser {04ffee41-5427-47e3-adb3-814bd29c89a3} 56098 true socket
kent       56183  0.0  0.8 2487568 143220 ?      Sl   Sep17   0:02 /opt/firefox/firefox-bin -contentproc -childID 1 -isForBrowser -prefsLen 47042 -prefMapSize 278527 -jsInitLen 234840 -parentBuildID 20240913135723 -greomni /opt/firefox/omni.ja -appomni /opt/firefox/browser/omni.ja -appDir /opt/firefox/browser {ecd88a31-15a8-4f94-8a0e-6cb56b522dd0} 56098 true tab
kent       56247  0.0  2.5 19928732 409184 ?     Sl   Sep17   0:31 /opt/firefox/firefox-bin -contentproc -childID 2 -isForBrowser -prefsLen 53337 -prefMapSize 278527 -jsInitLen 234840 -parentBuildID 20240913135723 -greomni /opt/firefox/omni.ja -appomni /opt/firefox/browser/omni.ja -appDir /opt/firefox/browser {be978a92-fd25-46ac-baf8-2ba248a5c82f} 56098 true tab
kent       56306  0.0  0.2 380812 48100 ?        Sl   Sep17   0:02 /opt/firefox/firefox-bin -contentproc -parentBuildID 20240913135723 -sandboxingKind 0 -prefsLen 53434 -prefMapSize 278527 -appDir /opt/firefox/browser {f39d0e7a-5650-43a3-8b93-2c88bf9bfa0c} 56098 true utility
kent       56315  0.2  1.2 2573256 195444 ?      Sl   Sep17   1:57 /opt/firefox/firefox-bin -contentproc -childID 3 -isForBrowser -prefsLen 39246 -prefMapSize 278527 -jsInitLen 234840 -parentBuildID 20240913135723 -greomni /opt/firefox/omni.ja -appomni /opt/firefox/browser/omni.ja -appDir /opt/firefox/browser {e15cda9c-3dcd-46d1-946f-78f93d3dfbf8} 56098 true tab
kent       56333  0.0  1.2 2559200 197656 ?      Sl   Sep17   0:04 /opt/firefox/firefox-bin -contentproc -childID 5 -isForBrowser -prefsLen 39246 -prefMapSize 278527 -jsInitLen 234840 -parentBuildID 20240913135723 -greomni /opt/firefox/omni.ja -appomni /opt/firefox/browser/omni.ja -appDir /opt/firefox/browser {c0a14ae9-d90b-4ca2-987b-cc61e7894746} 56098 true tab
kent       57630  0.0  2.1 2836080 343860 ?      Sl   Sep17   0:19 /opt/firefox/firefox-bin -contentproc -childID 7 -isForBrowser -prefsLen 39299 -prefMapSize 278527 -jsInitLen 234840 -parentBuildID 20240913135723 -greomni /opt/firefox/omni.ja -appomni /opt/firefox/browser/omni.ja -appDir /opt/firefox/browser {87ec3a5f-5c8d-400f-9ffe-ddb8202022dc} 56098 true tab
kent       59242  1.8  2.5 2843392 416660 ?      Sl   08:49   1:53 /opt/firefox/firefox-bin -contentproc -childID 9 -isForBrowser -prefsLen 39404 -prefMapSize 278527 -jsInitLen 234840 -parentBuildID 20240913135723 -greomni /opt/firefox/omni.ja -appomni /opt/firefox/browser/omni.ja -appDir /opt/firefox/browser {2abb31fd-7026-40db-a8ae-71497c77f3d9} 56098 true tab
kent       60153  0.1  0.6 610328 105056 ?       Sl   09:30   0:05 /opt/firefox/firefox-bin -contentproc -parentBuildID 20240913135723 -prefsLen 53666 -prefMapSize 278527 -appDir /opt/firefox/browser {a14ab8b9-b315-479d-ad27-a2168b0ab5b4} 56098 true rdd
kent       61261  0.2  1.2 2603024 209476 ?      Sl   09:44   0:08 /opt/firefox/firefox-bin -contentproc -childID 16 -isForBrowser -prefsLen 39404 -prefMapSize 278527 -jsInitLen 234840 -parentBuildID 20240913135723 -greomni /opt/firefox/omni.ja -appomni /opt/firefox/browser/omni.ja -appDir /opt/firefox/browser {a3c017f8-bf86-4b38-94fb-d4f98f22209a} 56098 true tab
kent       63370  0.0  0.4 2433392 78728 ?       Sl   09:52   0:00 /opt/firefox/firefox-bin -contentproc -childID 21 -isForBrowser -prefsLen 40608 -prefMapSize 278527 -jsInitLen 234840 -parentBuildID 20240913135723 -greomni /opt/firefox/omni.ja -appomni /opt/firefox/browser/omni.ja -appDir /opt/firefox/browser {08bef2de-142a-4c7f-b934-3283a0eaace8} 56098 true tab
kent       63424  0.1  0.9 2546592 157024 ?      Sl   09:53   0:03 /opt/firefox/firefox-bin -contentproc -childID 22 -isForBrowser -prefsLen 54870 -prefMapSize 278527 -jsInitLen 234840 -parentBuildID 20240913135723 -greomni /opt/firefox/omni.ja -appomni /opt/firefox/browser/omni.ja -appDir /opt/firefox/browser {05efb9e1-5730-45bf-af8e-a31aaa231ca7} 56098 true tab
kent       63915  0.0  0.3 2415356 57316 ?       Sl   09:58   0:00 /opt/firefox/firefox-bin -contentproc -childID 23 -isForBrowser -prefsLen 40608 -prefMapSize 278527 -jsInitLen 234840 -parentBuildID 20240913135723 -greomni /opt/firefox/omni.ja -appomni /opt/firefox/browser/omni.ja -appDir /opt/firefox/browser {ccf73f71-641e-4ac4-a463-98c130b9336e} 56098 true tab
kent       64071  0.0  0.3 2415372 57920 ?       Sl   10:02   0:00 /opt/firefox/firefox-bin -contentproc -childID 24 -isForBrowser -prefsLen 40608 -prefMapSize 278527 -jsInitLen 234840 -parentBuildID 20240913135723 -greomni /opt/firefox/omni.ja -appomni /opt/firefox/browser/omni.ja -appDir /opt/firefox/browser {1b08468c-1b98-4b26-9eb4-353e798c7d6d} 56098 true tab
kent       65216  0.1  0.3 2415112 57284 ?       Sl   10:31   0:00 /opt/firefox/firefox-bin -contentproc -childID 25 -isForBrowser -prefsLen 40608 -prefMapSize 278527 -jsInitLen 234840 -parentBuildID 20240913135723 -greomni /opt/firefox/omni.ja -appomni /opt/firefox/browser/omni.ja -appDir /opt/firefox/browser {750895ad-92c4-4cc6-975f-8abb750c62c5} 56098 true tab

/opt/firefox/firefox-bin is a DYN Position-Independent Executable file

Code: Select all

$ readelf -h /opt/firefox/firefox-bin
ELF Header:
  Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 
  Class:                             ELF64
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              DYN (Position-Independent Executable file)
  Machine:                           Advanced Micro Devices X86-64
  Version:                           0x1
  Entry point address:               0xb3b1e
  Start of program headers:          64 (bytes into file)
  Start of section headers:          984256 (bytes into file)
  Flags:                             0x0
  Size of this header:               64 (bytes)
  Size of program headers:           56 (bytes)
  Number of program headers:         12
  Size of section headers:           64 (bytes)
  Number of section headers:         31
  Section header string table index: 30

@kmathern If you see the parent ID, i.e. PPID of all the firefox-bin processes you would notice that it is the firefox process (PID=56098). So the parent process is not a PIE executable. And from there the attack vector might originate. firefox-bin is never the parent browser process.

[fehlix]

If you see the parent ID, i.e. PPID of all the firefox-bin processes you would notice that it is the firefox process (PID=56098). So the parent process is not a PIE executable. And from there the attack vector might originate. firefox-bin is never the parent browser process.

The parent process does not have any knowledge what the internet connecting child processes DYNed ram are using.
This response reads like FUD to incite fear and mistrust, which can lead to a paralysis of security judgment and a defensive rather than proactive mindset.

[siamhie]

@siamhie thanks for your inputs on LibreWolf. If I am not mistaken Vivaldi has removed from the chromium source code all the references and call backs to Google servers. Further after Opera was sold to an East Asian controlling interests a few people split off from Opera and founded Vivaldi. It may be the best of the world, chromiums and V8's power minus all the insidious tracking.
About LibreWolf, while using it have you come across broken websites and functionality that does not work? My only concern with LibreWolf is that it is supported by a small handful of volunteers. They do not have a structure in place like Mozilla. Nor the financial heft. If they were to scatter then LibreWolf would become defunct.

They have been around for 4 1/2 years, so I don't see them going away any time soon. (wiki page for LibreWolf)

According to the website PrivacyTests.org, LibreWolf, along with Brave Browser and Tor Browser, had the most privacy protection compared to other browsers.

As far as "broken websites" are concerned, uBO's block mode is set to Medium for most compatibility with web sites but I prefer
Hard mode (which breaks most web sites) but I know which cells to enable (temporarily) for the site to work. One feature I do like
about FF is Reader View. If I come across a site and I don't want to mess with enabling cells, I'll just view the site with reader view.

[Eadwine Rose]

My only concern with LibreWolf is that it is supported by a small handful of volunteers. They do not have a structure in place like Mozilla. Nor the financial heft. If they were to scatter then LibreWolf would become defunct.

Why are you even here? On MX Linux? After writing the above?

[siamhie]

My only concern with LibreWolf is that it is supported by a small handful of volunteers. They do not have a structure in place like Mozilla. Nor the financial heft. If they were to scatter then LibreWolf would become defunct.

Why are you even here? On MX Linux? After writing the above?

Here Here...+1


I totally glossed over this statement

Nor the financial heft

and would like to point out this from their FAQ page.

Why don't you accept donations?

We don't want to deal with the administration required to properly handle donations. If we don't need funding, we won't risk becoming dependent on it.
And also: no donations means no expectations. This means that people working on LibreWolf are free to move on to other projects whenever they want.