1715380 - Nightly does not restore SELinux context labels after manual update

Status: UNCONFIRMED

(Toolkit :: Application Update, defect)

Description

[Jeffrey G]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0

Steps to reproduce:

1. Manually download Firefox Nightly update via browser menu.
2. Click Yes to apply update and restart Nightly.
3. Check SELinux context labels in <install directory>

Actual results:

Firefox Nightly applies update then restarts without giving user opportunity to re-apply SELinux security context labels, presenting a potential security risk.

Nightly should have an option to apply update without restarting the browser, giving the user time to re-apply SELinux security context labels; or Nightly should allow the update to run via command line without starting up the browser thus allowing SELinux security context labels to be re-applied after update.

Expected results:

Browser should update without starting the browser giving users the opportunity to re-apply SELinux security context labels:

restorecon -rFvv <installation_directory>

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Toolkit::Application Update' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 2

[Robin Steuber (she/her) [:bytesized]]

Hello, thanks for filing a bug. I'm so sorry it has taken so long for someone to respond to it!

I'm not entirely sure that I understand what you are suggesting. I don't really know anything about SELinux, so I apologize if I ask questions with obvious answers.

I'm afraid that I don't really feel that I understand what you are asking for. There are two main ways that updates can be applied by Firefox:

1. An update is prepared while Firefox is running. The user eventually exits Firefox. The next time it launches, Firefox applies the update on startup.
2. An update is prepared while Firefox is running. It eventually prompts the user to restart to apply the update. Firefox then restarts and applies the update on startup.

I'm not sure how we would handle either of these cases the way you are suggesting. If we didn't start Firefox after updating in the first case, it would seem like you launched Firefox, but nothing would happen. Surely this would not be desirable. I guess in the second case, we ought to replace the "Restart" button with a shutdown button?

How should we decide whether or not Firefox should behave this way? Do you think that we should do this on every system? On every Linux system? On every Linux system with SELinux installed? On every Linux system with SELinux in some particular state?

You also give this command at the end, but I'm not really sure what the significance of it is:

restorecon -rFvv <installation_directory>

Are you suggesting that we run this as part of our installation process? Would that be in addition to the change where we don't restart after update, or instead of it?

---

In general, I don't actually suggest that Linux users update using our built-in updater. Usually I suggest that they update using a package manager. A big part of the reason behind this is that Firefox doesn't have a way of elevating to install updates on Linux. Thus, in order for the built-in updater to work, Firefox has to be run in such a way that it has permission to edit itself at runtime, which isn't really recommended for security reasons. Does SELinux address this issue somehow? Is there some reason that you don't want to use a package manager?

Comment 3

[Jeffrey G]

Actual results:

Firefox Nightly applies update then restarts without giving user opportunity to re-apply SELinux security context labels, presenting a potential security risk.

What I should have said:
Actual results:

Firefox Nightly applies update then restarts without giving user opportunity to re-apply SELinux security context labels FIRST, presenting a potential security risk.

A simple "restart now" button would suffice, allowing the user to re-apply the selinux labels before Firefox restarts. As of this moment Firefox just restarts without giving the user the opportunity to reapply the labels.

Comment 4

[Robin Steuber (she/her) [:bytesized]]

Setting S3 severity because this blocks non-critical functionality and a work around exists.