Browser Capable of "Full Access" to all Desktop Computer Partitions/Data

So, I tested Firefox (snap) on Xubuntu 26.04.

Even after tweaking the “about:config” settings that are recommended, I was unable to gain full unrestricted access to all content on all partitions on all drives on my Desktop Computer.

Suffice to say … NOT happy!

To circumvent that issue, I visualize 2 approaches:

  • [Method 1] set up my own desktop http server (which I am loathe to do because of the “visibility scope” restriction), using the suggested approach of
python3  -m http.server  ${localWebHostPort}

accessible via

http://localhost:${localWebHostPort}
  • [Method 2] Using an alternative browser which has the builtin capability for two profiles: (a) full security for remote access, and (b) open access for full localhost-attached partitions with no remote access.

My questions are as follows:

  • Are there any existing browsers which behave per Method 2 ?
    If so, which one(s) ?

  • Google AI has offered a mechanism (see below), using a self-signed certificate and a bash script, to operate with Method 1 using https ? Is that approach good enough to to simulate encryption/security handling as if those same files were installed on a remote host ?


Method: Custom Python Script (No External Tools)

Step 1: Generate a Self-Signed Certificate
Run this standard openssl command in your Linux terminal to generate a temporary certificate
and key:

openssl req -new -x509 -keyout key.pem -out cert.pem -days 365 -nodes

Step 2: Create the Python Script
Save the following code into a file named secure_server.py in the directory you want to share:

import http.server
import ssl

# Define server address and port
server_address = ('0.0.0.0', 4443)

# Create the standard HTTP handler and server instance
handler = http.server.SimpleHTTPRequestHandler
httpd = http.server.HTTPServer(server_address, handler)

# Wrap the socket with SSL context
context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
context.load_cert_chain(certfile='cert.pem', keyfile='key.pem')
httpd.socket = context.wrap_socket(httpd.socket, server_side=True)

print(f"Serving HTTPS on {server_address[0]} port {server_address[1]}...")
httpd.serve_forever()

Step 3: Run the Script

python3 secure_server.py

Note (from Google AI): Because this uses a self-signed certificate, your web browser will throw a “Security Warning.” This is normal for local testing; simply click “Advanced” and proceed.



Forgot to mention that I would like to double-click on any HTML page, regardless of location (within locally-attached devices), and have it open properly!

4 Likes

@ericmarceau, I suspect that AppArmor confinement of the Snap of Firefox on Ubuntu is limiting file system access. I would begin troubleshooting the issue with the following:

journalctl -f -o short-iso | grep -i apparmor

Please reproduce the issue in Firefox.

I think you will see a log entry vaguely similar to the following:

2019-07-17T04:58:28-0400 tessa audit[5427]: AVC apparmor="DENIED" operation="capable" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" pid=5427 comm="firefox" capability=21  capname="sys_admin"

4 Likes

I’m confused here by where you started.

snap packages by default run confined, and though it is possible to package them with unrestrained access to your file-system (needed for system tools), those apps will not be user [space] apps (normally) and tend to be few. (there was lots of talk on Ubuntu Mate’s Discourse back in the day when this was introduced; a single package that could work on all releases reduced workload as compared to deb for Ubuntu MATE developers)

Most of my own files exist in NFS shares that are outside of where a standard snap package can access; so I have a secondary mount of them in a location (not identical access; slightly more limited) which allows me to save/upload there when I want within a snap package such as browser apps.

The confined nature is usually marketed as a security benefit; as it only has (by default) access to your $HOME (and not even all files/directories there!) and specific other directory locations (some of those aren’t even default; eg. an answer I wrote here years ago when chromium was introduced though defaults are app specific (snap packager has some control). The view of your file-system seen by confined apps is a mix of your actual real file-system & a mix of the image located within the squashfs (which is RO so can’t be saved to anyway).

Don’t forget, if a browser has full access to your file-system, any rogue extensions or mistakes you make can cause data loss/corruption ; there are reasons for the marketed benefits confinement provides.

9 Likes

Why do you need the Internet browser to do what the file browser already does?

6 Likes

What I understand the “File Browser”, a.k.a. Caja, to do, does not cover the scope of access that I am looking for directly from within the Web Browser. :frowning:

I have always performed “Save Page Complete” for pages that I have deemed “critical” resources that I wanted to keep locally, instead of being unable to retrieve at time of need because

  • the remote URL has either been changed, or
  • the remote content has been deleted, or
  • the publishing site has gone defunct.

Such pages are spread throughout various Topic-specific directories located on different purpose-oriented partitions on my system.

I want to be able to access any such file, from anywhere on my system, and have it properly rendered (for any HTML/CSS/JS originating from locally-stored files referenced by the tags).

If I have to install a browser which has been gutted in such a way that it could never access the internet, I do not care. I do care about, and rather insist upon it, that I be able to load any and all locally-stored file if and when I choose to do so, without what anyone else considers (per their pre-conceived notions) that it is risky.

If the “source” docs represented risk, I would not have downloaded them. Period! Having thereby passed my own judgement “fence” to achieve a state of being locally-stored, they should be deemed fully “vetted” … and should not be subject to further question by browser-based rules and logic.

And that stance also applies to what I want to “test” as part of my own coding and development files.

What ever happened to the principle of “Master within my own house”???

That is my personal stance, for better or worse!



[1] For the originally stated problem …

In order to address the issue of full-scope, local-residency file access, I will likely have to stick to Deb-only Firefox and install that when I “upgrade” to Ubuntu 26.04 LTS. Therefore, from that standpoint, I will consider the issue provisionally closed, knowing that SNAP-based is to be banned for any service that I wish to incorporate. That will most likely force me away from Ubuntu at some point, given Canonical’s/Ubuntu’s stance on SNAPs, but identifying the replacement OS is a task deferred until a later date.

[2] Regarding the issue of “no-limitations” on loading and executing locally-stored HTML/CSS/JS by any HTML page opened with my Web Browser …

(Issue first encountered when trying to build my own web-based Battleship game. :frowning: )

The usage of a non-SNAP Debian package will not address the W3C security standards restrictions regarding the full-access to locally-stored HTML/CSS/JS loaded into a web page upon opening. I don’t want to have to work thru a web-server, or node.js, or any other such thing. I simply want to load my HTML page with all its embedded specifications for importing of separate files for HTML/CSS/JS.

For this dimension of the issue, I am still searching for a proper solution.

3 Likes

@ericmarceau, assuming that this is an AppArmor block, please consider creating a ‘local override’:

The local override should contain ‘file rules’ to the directories that you wish Firefox to be able to access:

Using this technique will allow you to whitelist (allow list) the necessary directories without reducing the security to Firefox.

3 Likes

Thanks Eric, not sure I understand the whole thing, but I do use a web browser to store HTML pages myself so I kind of understand what you are after.

2 Likes

Thank you, Marshall.

I went back to my test setup, and the journal command did not report any instances of blockage by AppArmor. :frowning:

Instinctively, I don’t think that is what is preventing my desired approach to “global access” of local files. I believe it is the two different modes of restrictions at play:

  • SNAP-driven security sandboxing
    (not prepared to create links and other workarounds to get the desired level of access from within SNAP),       and

  • W3C internet consortium security standards limiting “direct-loading” actions (this is my biggest gripe).



Thank you also for that quick references to AppArmor Profiles.

I looked at this statement:

Entries for specific (non-globbed) directories should have a trailing slash at the end. For example, /path/to/obj rw grants permissions for a file obj, while /path/to/obj/ rw grants permissions for a directory obj.

Given W3C tendencies, I do not believe that the directives regarding directory give full resursive access to any specified directories. From that stance, it is my inference that it whitelists only the immediate contents of those specified directories.

3 Likes

Greetings all,

@ericmarceau you are not alone in this issue. When I first typed files:/// in the URL bar and saw the browser had full access the entire system, I was dumbfounded at how this has not been addressed.

This is why I started testing AppImages with Firejail.

In my latest ISO, which I just posted on here yesterday, I specifically defaulted the Firefox and zen-browser to AppImage with the ability to also run it in jailed mode!

By default the browser runs as a normal browser, but launching the browser using the contextual menu of the launcher (right click on the icon), also gives the option to run in jailed mode. See this thread

The default profile running in Firejail, blocks all directories in the ~/ except Documents and Downloads. But you can add your own settings in the local profile directory, ~/.config/firejail/firefox.profile

Start here on Firejail https://firejail.wordpress.com/

You are more than welcomed to try my ISO to see how it works, it all works in the LIVE ISO, no need to install. Sorry about the size…

P.S. I guess I should add the link to the ISO New DeLinuxCo ISO ready! 26.1.0

3 Likes