sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Apply chromium policy hardening

Browse Source
This commit is contained in:
Audiobuzz
2026-06-28 03:18:54 +00:00
parent ad6b7e3366
commit 2cf7ad4ffb
2 changed files with 23 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/TODO.md
+20 -17
View File
@@ -1106,20 +1106,23 @@ SELinux AVC for `dri_device_t` from the kiosk domain (Wazuh `fleet_audit` 100120
will surface any — if present, add a scoped SELinux allow or confirm the kiosk
user's SELinux mapping is unconfined). Confirm VMs still render (software path).
**DECISION OPEN — Chromium flag ownership (security).** The distro chromium
wrapper PREPENDS vendor defaults we don't control, including capability-broadening
ones a locked kiosk arguably shouldn't carry: `--enable-extensions`,
`--enable-user-scripts`, `--enable-plugins`, `--enable-printing`,
`--auto-ssl-client-auth`, `--enable-sync`. Today the managed policy neutralises
the security-relevant ones (sync off via `SyncDisabled`; sign-in/metrics/etc.),
but extensions/user-scripts/auto-ssl-client-auth are NOT policy-locked. Option to
**own the full flag set**: bypass/neutralise the wrapper (invoke the real binary,
or empty its default-flags source) and specify everything ourselves incl. the
VA-API `--enable-features` (now known:
`AllowQt,WaylandLinuxDrmSyncobj,WaylandPerSurfaceScale,WaylandUiScale,AcceleratedVideoDecodeLinuxGL,AcceleratedVideoDecodeLinuxZeroCopyGL,AcceleratedVideoEncoder`).
Tradeoff: full determinism + drop unwanted capabilities, vs we then track Chromium
feature renames ourselves instead of inheriting the distro's. Also fully dedupes
`--disable-features`/`--enable-sync`. Needs locating the wrapper's flag source on
the box first (so we don't lose VA-API or break its env setup). Pairs with policy
adds: `ExtensionInstallBlocklist=["*"]`, disable user scripts, restrict
AutoSelectCertificateForUrls.
**DECIDED 2026-06-28 — Option 1 (policy lock), APPLIED.** The distro chromium
wrapper (`/usr/bin/chromium-browser`) layers flags as `$CHROMIUM_FLAGS`
(`/etc/chromium/chromium.conf` → VA-API enables + AI disables; overridable via
`CHROMIUM_USER_FLAGS`) + **hardcoded** `$CHROMIUM_DISTRO_FLAGS`
(`--enable-plugins --enable-extensions --enable-user-scripts --enable-printing
--enable-sync --auto-ssl-client-auth`) + our `"$@"` (last). The hardcoded layer
isn't removable via env/conf — only by bypassing the wrapper. Rather than bypass
(Option 2, which would force us to replicate the wrapper's stdio sanitisation +
own the VA-API feature list across updates), we **neutralise in managed policy**
(policy beats cmdline flags, survives updates): `ExtensionInstallBlocklist=["*"]`
added to `files/kiosk/chromium-kiosk-policy.json` (blocks all extensions → also
kills the user-scripts surface). `--enable-sync` already locked by `SyncDisabled`;
`--auto-ssl-client-auth` is moot (no browser-store client cert; the TPM 802.1X
cert isn't one) — `AutoSelectCertificateForUrls` left unset. VA-API enables
inherited from `chromium.conf` unchanged. Option 2 (full flag ownership, bypass
the wrapper, own the VA-API `--enable-features`:
`AllowQt,WaylandLinuxDrmSyncobj,WaylandPerSurfaceScale,WaylandUiScale,AcceleratedVideoDecodeLinuxGL,AcceleratedVideoDecodeLinuxZeroCopyGL,AcceleratedVideoEncoder`)
remains documented here if a minimal/auditable cmdline is ever wanted.
**BENCH-VERIFY:** `chrome://policy` shows `ExtensionInstallBlocklist=["*"]` active;
extensions can't install.