extras/firefox-profiles/

Give a website you stay logged into its own Firefox profile:

firefox --new-profile        (or: bash extras/firefox-profiles/new-profile.sh)

firefox --profiles lists the profiles you have, and `firefox --remove-profile NAME` removes one; Tab completes the options and the profile names.

It asks for a short name (e.g. bank) and the site's address, and makes:

• a Linux user of its own, fx-bank, locked down like the sandboxed Firefox (extras/firefox-sandbox.sh): no password, no login, none of your files,
• a Firefox profile in that user's home, with its own cookies, logins, history and settings, which opens that site when it starts, and
• a command, bank, that starts it. Super+d finds it too. When a program is called that already (git, mail...), the command is firefox-bank instead, so it never stands in for that program.

It asks whether to keep the profile's cookies when it closes (keep: you stay logged in, the usual reason for a profile) or delete them (logged out each time; --delete-cookies).

Its window shows only the page: no tabs, address bar or bookmarks bar, and links open in the same tab. The keys still work (Alt+Left back, Alt+Right forward, F5 reload, Ctrl+W close). To keep Firefox's toolbars for a profile, make it with --show-toolbars at the end.

It needs the sandboxed Firefox set up first, and offers to do that.

Or in one go: bash extras/firefox-profiles/new-profile.sh bank https://mybank.example.

Why it's useful

A browser profile is a separate compartment. Sites in one profile can't see the cookies, logins or stored data of another, so:

• Trackers can't follow you between them. If your Google, shopping or social media accounts live in their own profiles, those companies don't see what you do in the rest of your browsing.
• Your most sensitive logins are kept apart. A banking or email profile that only ever opens that one site is never exposed to the random sites you visit elsewhere.
• You stay logged in where you want to, without that login being available to every other site.

Each profile runs as its own Firefox, as its own user, so they can be open side by side. Pass an address to open it in that profile: bank https://mybank.example/statements.

Good candidates: banking, email, crypto exchanges, shopping, a Google or work account, social media. Sites you don't log into don't need one.

What each user is, and what it shares

• Your files are out of reach. The profile's user can read none of your files, ssh keys or passwords. Its home (/var/lib/wren-fx/NAME, mode 700) can't be read by your user either, but that doesn't keep a program running as you out of the profile: you start it, so such a program can start it too, show it pages and type into its window (see "Anything running as you" in THREAT-MODEL.md).
• Profiles can't read each other. Each has its own user, its own sound pipe, its own folder in memory, and its own downloads folder, ~/Downloads/NAME, which is shared with you and with no other profile.
• Shared with you: the clipboard (while that window has focus) and its downloads folder. Treat what lands there as untrusted.
• No screen reading or typing for you, and no audio server or microphone: the same restricted screen access and sound pipe as the sandboxed Firefox.
• Blocked from your local network: one firewall rule covers every profile (they all share the group wren-fx). `sudo systemctl stop wren-firefox-firewall` lifts it for a while.
• Still shared: the kernel (a kernel bug could still get out), and your IP address. Disk encryption, few extensions and Tor Browser (for anonymity) cover the rest; see THREAT-MODEL.md in the main folder.
• Settings: the address and its choices (JavaScript, sound, cookies) are in /etc/wren/firefox-profiles/NAME.conf, writable only by root, so a hacked profile can't change them, and readable only by root, you and that profile's own user: another profile (or the sandboxed Firefox) can't read which sites you keep profiles for, or list them.

Profiles made by an earlier version of this script (in your own Firefox, as you) keep working; --remove NAME still removes them as before.

Fast JavaScript

Wren Linux turns Firefox's JavaScript JIT off in every profile (see parts/firefox-hardening.sh): JavaScript runs slower, but most serious browser exploits target the JIT. Heavy web apps such as webmail, online office suites or chat may feel sluggish without it. Answer yes to "Fast JavaScript for this site?" (or add --fast-js) to turn it back on for that one profile only.

Removing one

bash extras/firefox-profiles/new-profile.sh --remove bank removes the bank command (or firefox-bank, from an older version), the permission to run it and its settings file, then asks whether to delete the profile's logins and its user too. Say no and they are kept (the user stays locked) until you remove them. Files it downloaded stay in ~/Downloads/bank.

Files

• new-profile.sh: the script you run.
• ../../lib/firefox-profiles.sh, ../../lib/firefox-sandbox.sh: its helpers (sourced, not run): the profile, the user, the sudo rule.

Each profile's settings are in its user.js, written at every start from /etc/wren/firefox-profiles/NAME.conf. Profiles live in /var/lib/wren-fx/NAME/profile.