image: tighten the Firefox and Chromium sandboxes

Firefox held devices=all (webcam, microphone, raw USB — a browser needs the GPU;
WebRTC capture goes via the portal regardless) and features=devel, which relaxes
the in-sandbox seccomp filter to allow ptrace and perf. That is a debugging
affordance weakening the boundary around the most hostile input on the machine.

Chromium could write .desktop files to ~/.local/share/applications via :create.
A .desktop entry executes outside the sandbox, so that is a straightforward
escape. Host /tmp went with it. Cost: PWA/"Create shortcut" install stops
working; ~/.local/share/icons is left alone because revoking it buys nothing once
the .desktop path is gone.

Both verified before committing, as --user overrides, which reproduce a system
override exactly: Chromium maps a window, and Firefox headlessly rendered a real
page to a valid PNG so content processes still work. After the Discord override
crash-loop, overrides get tested rather than reasoned about.

Author: mark-iid

SETUP.md

@@ -225,7 +225,17 @@ bluetooth audio, and suspend/resume. Only then wipe the internal drive (§9.10).
       sudo flatpak override --system --nosocket=x11 com.bitwarden.desktop
       sudo flatpak override --system --nofilesystem=home --filesystem=xdg-download \
         com.github.IsmaelMartinez.teams_for_linux
+      sudo flatpak override --system --nodevice=all --device=dri --disallow=devel \
+        org.mozilla.firefox
+      sudo flatpak override --system --nofilesystem=/tmp \
+        --nofilesystem=~/.local/share/applications \
+        io.github.ungoogled_software.ungoogled_chromium
       ```
+      > **Test any new override before trusting it.** Apply it as `--user` first,
+      > launch the app, and confirm it actually runs — a `--user` override
+      > reproduces a system one's effect exactly. An override on
+      > `com.discordapp.Discord` silently crash-looped that app for months while
+      > everyone blamed zypak. Overrides are not free.
       Verify with `flatpak info --show-permissions <app>` — the effective
       `[Context]` should show `!x11` / `!home` merged in.
 - [ ] Restore by hand, encrypted (never via repo/image, §10): `~/.ssh`, `~/.gnupg`,

files/system/usr/lib/tmpfiles.d/kb3lyb-flatpak-overrides.conf

@@ -13,6 +13,8 @@ d /var/lib/flatpak/overrides 0755 root root - -
 C /var/lib/flatpak/overrides/com.slack.Slack 0644 root root - -
 C /var/lib/flatpak/overrides/com.bitwarden.desktop 0644 root root - -
 C /var/lib/flatpak/overrides/com.github.IsmaelMartinez.teams_for_linux 0644 root root - -
+C /var/lib/flatpak/overrides/org.mozilla.firefox 0644 root root - -
+C /var/lib/flatpak/overrides/io.github.ungoogled_software.ungoogled_chromium 0644 root root - -
 #
 # DELIBERATELY NO com.discordapp.Discord LINE. An override on Discord — even just
 # `sockets=wayland;fallback-x11;` with no environment block — makes its renderer

files/system/usr/share/factory/var/lib/flatpak/overrides/io.github.ungoogled_software.ungoogled_chromium

@@ -0,0 +1,16 @@
+[Context]
+# !~/.local/share/applications — the manifest grants this with :create, letting
+# the browser write .desktop files onto the host. That is a well-known flatpak
+# sandbox escape: a .desktop entry runs OUTSIDE the sandbox when launched, so
+# anything that can write one can arrange host code execution at the next click.
+#
+# !/tmp — host /tmp is shared with every other process on the system; a browser
+# has no reason to read or write it.
+#
+# COST: "Create shortcut…" / PWA install no longer works. `~/.local/share/icons`
+# is deliberately left alone — with the .desktop path revoked, PWA install is
+# already broken, so revoking icons too would buy nothing.
+#
+# VERIFIED: Chromium launches and maps a window with these applied (it is slow to
+# start, ~50s, which is normal for it and not a symptom).
+filesystems=!/tmp;!~/.local/share/applications;

files/system/usr/share/factory/var/lib/flatpak/overrides/org.mozilla.firefox

@@ -0,0 +1,15 @@
+[Context]
+# devices=!all;dri — the manifest grants `all`, which is every device node the
+# sandbox can see: webcam, microphone, raw USB. A browser needs the GPU, not the
+# camera; WebRTC capture goes through the portal, which is not affected by this.
+#
+# features=!devel — `devel` relaxes the seccomp filter INSIDE the sandbox to
+# permit ptrace and perf. That is a debugging affordance, and it weakens the one
+# boundary containing the most hostile input on the machine.
+#
+# VERIFIED, not assumed: with both applied, a headless render of a real page in a
+# fresh profile produced a valid PNG, so content processes still work. Tested as a
+# --user override first, which reproduces a system override's effect exactly (the
+# com.discordapp.Discord incident proved that equivalence in the other direction).
+devices=!all;dri;
+features=!devel;