#!/bin/bash
# Firefox hardening, for every profile:
#  - uBlock Origin (from Debian) in "medium mode": scripts and frames from
#    other sites are blocked everywhere. That's where most malicious ads
#    and drive-by attacks come from. Allow a site that breaks with:
#    ublock-allow example.com
#  - The JavaScript JIT is off. Most serious Firefox exploits target it.
#    JavaScript still works, a bit slower; heavy web apps may lag. A
#    profile can turn it back on (extras/firefox-profiles/new-profile.sh asks).
#  - HTTPS-Only Mode: Firefox won't load unencrypted pages without asking,
#    so nobody on café or hotel Wi-Fi can tamper with them.
#  - (Firefox's own DNS is set by each Wren Linux Firefox at its start, not here:
#    bin/firefox-session and bin/incognito-session.)
#  - A notice when Firefox was updated while it's running: the running
#    browser keeps the old, unfixed version until you restart it.
# These are defaults: change one in a profile at about:config.
# Usage: bash firefox-hardening.sh [--remove]
# status: file:/etc/firefox-esr/wren-hardening.js
. "$(dirname -- "${BASH_SOURCE[0]}")/../lib.sh"
need_user

# Debian's Firefox reads default prefs from /etc/firefox-esr/*.js and
# policies from /usr/share/firefox-esr/distribution/policies.json
ETC=/etc/firefox-esr
DIST=/usr/share/firefox-esr/distribution
PREFS="$ETC/wren-hardening.js"
ALLOW=/usr/local/bin/ublock-allow
UNITS="$HOME/.config/systemd/user"

if [ "${1:-}" = --remove ]; then
    systemctl --user disable --now firefox-restart-check.timer >/dev/null 2>&1 || true
    rm -f "$UNITS/firefox-restart-check.service" "$UNITS/firefox-restart-check.timer"
    remove_bin firefox-restart-check
    # DIST is where it is now; ETC/policies is where an earlier version put it
    for d in "$DIST" "$ETC/policies"; do
        if [ -f "$d/.wren-written" ] && sha256sum --status -c "$d/.wren-written"; then
            sudo rm -f "$d/policies.json" "$d/.wren-written"
            sudo rmdir "$d" 2>/dev/null || true
        fi
    done
    sudo rm -f "$PREFS" "$ETC/wren-ublock-allow" "$ETC/wren-bookmarks.json" "$ALLOW"
    # Firefox and uBlock Origin stay while the Firefox extra is installed (its own
    # marker package keeps them); extras/firefox-sandbox.sh --remove takes them out
    apt_purge
    note "Firefox is back to its own defaults after a restart."
    exit
fi

say "Firefox hardening"
apt_install firefox-esr webext-ublock-origin-firefox libnotify-bin

sudo install -m 0644 "$WREN_DIR/data/firefox-hardening.js" "$PREFS"
note "HTTPS-Only Mode on, JavaScript JIT off, blank foxy home page ($PREFS)"

sudo install -m 0644 "$WREN_DIR/data/firefox-bookmarks.json" "$ETC/wren-bookmarks.json"
note "A \"Learn (Wren Linux)\" bookmarks folder: Linux, Bash, sed and awk, security, programming."
sudo install -m 0755 "$WREN_DIR/bin/ublock-allow" "$ALLOW"
if sudo "$ALLOW" --refresh; then
    note "uBlock Origin blocks other sites' scripts and frames. When a site breaks:"
    note "  ublock-allow example.com   standard mode for that site (then restart Firefox; --list shows them)"
else
    warn "uBlock Origin's medium mode isn't set; see above."
fi

say "Firefox update notice"
mkdir -p "$UNITS"
install_bin firefox-restart-check
cat >"$UNITS/firefox-restart-check.service" <<EOF
[Unit]
Description=Tell me when Firefox needs a restart after an update (Wren Linux)

[Service]
Type=oneshot
ExecStart=$BIN/firefox-restart-check
EOF
cat >"$UNITS/firefox-restart-check.timer" <<'EOF'
[Unit]
Description=Check every 10 minutes whether Firefox needs a restart (Wren Linux)

[Timer]
OnStartupSec=2min
OnUnitActiveSec=10min

[Install]
WantedBy=timers.target
EOF
if systemctl --user daemon-reload 2>/dev/null &&
    systemctl --user enable --now firefox-restart-check.timer >/dev/null 2>&1; then
    note "Checks every 10 minutes and shows a notification when Firefox needs a restart."
else
    warn "Couldn't start the check now; it starts with your next login."
    systemctl --user enable firefox-restart-check.timer >/dev/null 2>&1 || true
fi
note "Restart Firefox for all of this to take effect."