267303 - Don't start Firefox after install, if root

Status: RESOLVED INVALID

(Firefox :: Installer, defect)

Description

[Ben Bucksch (:BenB)]

Appearantly, the Installer launches Firefox after the installation completed,
even if the Installer ran as root, resulting in a Firefox running as root.

That's a very bad idea security-wise, applications should never (not even once)
run as root. This basically leads or even trains the user to cut himself.

Compare bug 247412.

It's also reason for user confusion, because the profile probably is being
created under root's home, not the user's home, so all configuration during the
first run (where people typically configure the app) is practically lost after
the user restarts the computer.

Suggested fix:
- If Installer runs as root, don't start Firefox automatically.
- If that's too complicated, don't start Firefox automatically after
installation at all.

Comment 1

[sairuh (rarely reading bugmail)]

see also bug 252318.

Comment 2

[Logan Ingalls]

Fixing this would also work around the biggest part of the serious WONTFIXed
dataloss bug 205053.

Comment 3

[Asa Dotzler [:asa]]

not gonna happen for 1.0

Comment 4

[Andrew Schultz]

firefox has to be run once as the user who installed it.  see bug 252318 comment 3

Comment 5

[James Norris]

(In reply to comment #4)
> firefox has to be run once as the user who installed it.  see bug 252318 comment 3

Then can we either have a dialogue box saying "if you installed as root, please
close firefox and run it as yourslef, it's dangerous to run as root"

Or just have those files run after insstallation on Linux, rather than the whole
app.??

Comment 6

[Ben Bucksch (:BenB)]

> firefox has to be run once as the user who installed it.

That's a bug. That's the reason why regchrome and regxpcom have been written for
 seamonkey.

Comment 7

[Ben Bucksch (:BenB)]

(or used)

Comment 8

[Carsten Book [:Tomcat]]

Since we no longer provide a Installer for Firefox Linux Builds, i close this bug as invalid.