Puppy Linux Discussion Forum

If I understand the documentation correctly, Chrome browser can be installed from the "SFSget" link on the desktop, which will access the online SFS repository, right?

Is this a user-generated SFS file of Chrome that is manually maintained by a user (and requires manual maintenance to include updates) or will this automatically install the latest Chrome version from the official Google repository (wget https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb)?

Once it is installed, how do you update to the latest Chrome version (EasyOS loaded into RAM only)?

Thanks for your feedback!

The Chrome and Chromium SFSs are rather old.
I haven't tried whether they can be updated. I presume that it has an update feature.

My focus shifted to Firefox, partly because it is considerably smaller, enabling it to be included builtin to EasyOS.

Firefox does have an update feature, but I have turned it off in the settings. Instead, I include the latest FF in every new version of EasyOS.

Thanks @BarryK. I like the sandbox feature of Chrome, but latest version of Firefox will do.

Considering that the browser is the main attack vector of a system nowadays, I think it's important to keep your browser version up-to-date.

So to get the latest Firefox version, you would have to update the complete EasyOS installation on your USB as explained in the following (I am planning to use the RAM method booted from USB without hard drive installation)?

https://easyos.org/user/how-to-update-easyos.html

You would have to do a normal bootup from usb stick, then click the "update" icon on the desktop.
That will install the latest vmlinuz, initrd and easy.sfs on your usb stick.

Then go back to bootup to running in ram only, and you will have the latest FF.

FF does have a sandbox.

So even when running with a normal bootup, FF will be running as user "firefox" and with its own sandbox. Which I think is pretty secure.

But yeah, the ultimate is to bootup running in ram only.

Noted @BarryK. When you are booting into RAM mode only from USB, can you run Firefox within a container on that desktop?

Neo_78 wrote: ↑Wed Aug 31, 2022 8:36 pm

Noted @BarryK. When you are booting into RAM mode only from USB, can you run Firefox within a container on that desktop?

No, it is an alternative security mechanism to containers.

I just had a look at the docs:

https://bkhome.org/news/201908/easyos-b ... n-ram.html

"You are then on a desktop that is "contained", without containers. In fact, all container functionality is removed, as it requires mount capability. Everything works as normal, except that you cannot access any partitions."

So containers only work if you install EasyOS on a hard drive?

There is technically not a way to boot EasyOS from USB into RAM with a pre-configured, already mounted container that directly opens Firefox or application of choice?

From my experience, I believe that there is no need to have a container when you are lock downed in RAM. When you chose «copy session and disable drive" when you reboot "lock down in RAM", you actually set the kernel in confidentiality mode, which limits even the root user (ultra safe mode). But this is just one alternative for using EasyOS.

The default image (.img) is to be installed on a USB stick and not necessarily a hard drive. When you boot from this USB in the regular mode (not lock downed), the containers you see are indeed "in RAM" and changes to these containers are only written down to the USB stick if you click the "Save" or answer yes to saving at the end of the session. Furthermore, in that mode, when using Firefox, you are not in root mode, but rather in a user called "Firefox" which is a non-root user. So you can choose either to use the Firefox instance in a container, or the regular Firefox instance which is still non-root.

To go back to the main question, here is how I personally use EasyOS to maintain the latest version of Firefox (which might be useful when Barry is doing other stuff, I believe it would be to much to ask him to follow every Firefox releases). I only do this in the main instance, not in the containers:

- I boot in the regular mode.
- I download Firefox from the Mozilla website (through the existing Firefox or Seamonkey).
- This will provide you with a tar archive of the latest version of Firefox, which you can extract to the repository /usr/lib which is where the original version of Firefox is stored.
- Then, when I restart Firefox, I get the latest version and not the one from EasyOS itself.
- If you want this update to be permanent, you can save the session (click on the "save" button on the desktop).
- If you want to be ultra-safe, then reboot the computer using the lock down in RAM (the second option which ends with "disable drives").

Just keep in mind that doing so, this update version sits on top of the base version from EasyOS. Therefore, you will need to repeat the installation procedure every now and then. Also, when doing this, the containerized version of Firefox is not updated.

Thanks for your detailed explanation @Average72. In a RAM-only session, unfortunately it is still possible to hijack the browser of a non-root user. A skilled attacker with time and effort would also be capable to create a persistent infection of the mainboard by flashing the firmware with a bootloader. I am not sure why hardware manufacturers decided that mainboards do not require physical jumpers any longer that prevent unauthorized, remote flashing...

A note about updating FF and SM.
In woofQ, there are scripts that download the latest versions of FF and SM.
I no longer compile them.
Before doing a new release of EasyOS, I run the FF download script.
Not so bothered with keeping SM up to date. Well, it is only FF that bumps versions frequently.