Hardened user.js by pyllyukko

.gitignore

@@ -1,3 +1,3 @@
 openvpn
-shared
+local
 *~

Dockerfile

@@ -1,4 +1,4 @@
-FROM ubuntu:jammy
+FROM ubuntu:bionic
 
 RUN apt-get update && apt-get install -y firefox \
   curl sudo openvpn transmission \
@@ -24,4 +24,3 @@ COPY files/start-openvpn-blocking.sh /home/user/
 
 ENV HOME /home/user
 ENTRYPOINT ["/bin/bash", "/home/user/start.sh"]
-CMD ['firefox']

README.md

@@ -10,10 +10,10 @@ without any cookies, history or such.
  2. (optional) Create a directory `openvpn` and put your `openvpn.conf` there.
     Make sure it's called `openvpn.conf` and all extra files it may need are
     also in the `openvpn/` directory (this will be mounted in the container)
- 3. Start container `./run.sh firefox`
+ 3. Start container `./run.sh`
 
-Also `ASSERT_COUNTRY=Finland ./run.sh firefox` to check that ifconfig.co thinks
-that the your IP address is in a given country before starting Firefox.
+ Also `ASSERT_COUNTRY=Finland ./run.sh` to check that ifconfig.co thinks that
+ the your IP address is in a given country before starting Firefox.
 
 ### Disclaimer
 

files/start.sh

@@ -1,7 +1,12 @@
 #!/bin/bash
 set -e
-COMMAND="$1"
-echo "$COMMAND"
+
+# If no profile ...
+if [ ! -d "$HOME/.mozilla" ]; then
+  # create the default Firefox profile and put some settings there
+  firefox -CreateProfile default
+  mv $HOME/user.js `find $HOME/.mozilla/firefox -type d | grep .default`
+fi
 
 OPENVPN_CONF='/etc/openvpn/openvpn.conf'
 if [ -f "$OPENVPN_CONF" ]; then
@@ -24,24 +29,5 @@ if [ ! -z ${ASSERT_COUNTRY+x} ]; then
   fi
 fi
 
-# If no profile ...
-if [ $COMMAND == "firefox" ]; then
-  # create the default Firefox profile and put some settings there
-  firefox &
-  FIREFOX_PID=$!
-  # Since some recent Firefox version, calling CreateProfile and copying
-  # user.js stopped working on the first use for reasons I could not find on
-  # Google and do not frankly care about. This is the workaround
-  set +e
-  while [ `find $HOME/.mozilla/firefox -type f | grep prefs.js | wc -l` == "0" ];
-  do
-    echo "... waiting for Firefox to start the first time"
-    sleep 1
-  done
-  set -e
-  echo "killing Firefox and copying settings"
-  kill $FIREFOX_PID
-  mv $HOME/user.js `find $HOME/.mozilla/firefox -maxdepth 1 -type d | grep .default-release`
-fi
-
-$COMMAND
+# Start firefox
+firefox

files/user.js.d/user.js

@@ -9,38 +9,3 @@ user_pref("browser.onboarding.enabled", false);
 
 // no tracking protection intro
 user_pref("privacy.trackingprotection.introCount", 100);
-
-// use FF's fingeprinting blocker (spoofs various attributes and restricts canvas usage)
-user_pref("privacy.resistFingerprinting", true);
-
-// FF's tracking protection
-user_pref("privacy.trackingprotection.enabled", true);
-
-// Disable PDF's
-user_pref("pdfjs.disabled", true);
-
-// Disable various suspicious telemetry things (from pyllyukko's user.js)
-user_pref("browser.safebrowsing.downloads.remote.enabled", false);
-user_pref("browser.selfsupport.url", "");
-user_pref("dom.flyweb.enabled",	false);
-user_pref("toolkit.telemetry.enabled", false);
-user_pref("toolkit.telemetry.unified", false);
-user_pref("experiments.supported", false);
-user_pref("experiments.enabled", false);
-user_pref("experiments.manifest.uri", "");
-user_pref("network.allow-experiments", false);
-user_pref("breakpad.reportURL",	"");
-user_pref("browser.tabs.crashReporting.sendReport", false);
-user_pref("browser.crashReports.unsubmittedCheck.enabled", false);
-user_pref("devtools.webide.enabled", false);
-user_pref("devtools.webide.autoinstallADBHelper", false);
-user_pref("devtools.webide.autoinstallFxdtAdapters", false);
-user_pref("devtools.debugger.remote-enabled", false);
-user_pref("devtools.chrome.enabled", false);
-user_pref("devtools.debugger.force-local", true);
-user_pref("loop.logDomains", false);
-user_pref("browser.pocket.enabled", false);
-user_pref("extensions.pocket.enabled", false);
-user_pref("extensions.shield-recipe-client.enabled", false);
-user_pref("app.shield.optoutstudies.enabled", false);
-user_pref("browser.newtabpage.activity-stream.feeds.section.topstories", false);

run.sh

@@ -2,12 +2,8 @@
 set -eux
 docker run -ti --rm -e DISPLAY \
   --cap-add=NET_ADMIN --device /dev/net/tun \
-  --shm-size 256M \
   -v /tmp/.X11-unix:/tmp/.X11-unix \
   -v `pwd`/openvpn:/etc/openvpn \
-  -v `pwd`/shared:/home/user/Downloads \
   -e ASSERT_COUNTRY \
-  --name docker-vpn-browser-container \
   --dns 1.1.1.1 \
-  docker-vpn-browser \
-  "$@"
+  docker-vpn-browser