{"action":"created","issue":{"url":"https://api.github.com/repos/netblue30/firejail/issues/959","repository_url":"https://api.github.com/repos/netblue30/firejail","labels_url":"https://api.github.com/repos/netblue30/firejail/issues/959/labels{/name}","comments_url":"https://api.github.com/repos/netblue30/firejail/issues/959/comments","events_url":"https://api.github.com/repos/netblue30/firejail/issues/959/events","html_url":"https://github.com/netblue30/firejail/issues/959","id":193743419,"number":959,"title":"Firefox blacklist violation for fontconfig","user":{"login":"acrobat1","id":1692349,"avatar_url":"https://avatars.githubusercontent.com/u/1692349?v=3","gravatar_id":"","url":"https://api.github.com/users/acrobat1","html_url":"https://github.com/acrobat1","followers_url":"https://api.github.com/users/acrobat1/followers","following_url":"https://api.github.com/users/acrobat1/following{/other_user}","gists_url":"https://api.github.com/users/acrobat1/gists{/gist_id}","starred_url":"https://api.github.com/users/acrobat1/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/acrobat1/subscriptions","organizations_url":"https://api.github.com/users/acrobat1/orgs","repos_url":"https://api.github.com/users/acrobat1/repos","events_url":"https://api.github.com/users/acrobat1/events{/privacy}","received_events_url":"https://api.github.com/users/acrobat1/received_events","type":"User","site_admin":false},"labels":[{"id":246547501,"url":"https://api.github.com/repos/netblue30/firejail/labels/information","name":"information","color":"f7c6c7","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-12-06T11:04:13Z","updated_at":"2016-12-18T01:08:49Z","closed_at":null,"body":"I have no idea if this is a relevant issue or am I doing something I'm not supposed to, however if I run Firefox with the **--private=directory option** in Firejail  0.9.44 with a profile and/or commandline option to blacklist /home/user/.cache/fontconfig, after a while I can see this message in the logs \r\n\r\n`blacklist violation - sandbox 10331, exe firefox, syscall access, path /home/user/.cache/fontconfig`\r\n\r\n`blacklist violation - sandbox 10331, exe firefox, syscall access, path /home/user/.fontconfig`\r\n\r\nso not only Firefox is using the .cache/fontconfig directory in the private directory, it is also creating a new .fontconfig directory at the upper level: is that an issue?\r\n\r\nDoes Firefox absolutely need to use the fonts cache?\r\n As far as I can see, apparently this is only happening when using  the **--private=directory** option (first I launch Firefox to let firejail create the new firefox profile inside that private directory, than overwrite its contents with files from a custom profile), otherwise I can't see that message in the logs - so why would Firefox need to access the fonts config only with --private=directory option, violating the blacklisting, and apparently respect the  fontconfig blacklisting in \"normal\" sandboxed mode ?\r\n\r\nIsn't the font cache a vector for some kind of fingerprinting/tracking activity?"},"comment":{"url":"https://api.github.com/repos/netblue30/firejail/issues/comments/267797064","html_url":"https://github.com/netblue30/firejail/issues/959#issuecomment-267797064","issue_url":"https://api.github.com/repos/netblue30/firejail/issues/959","id":267797064,"user":{"login":"chiraag-nataraj","id":14947779,"avatar_url":"https://avatars.githubusercontent.com/u/14947779?v=3","gravatar_id":"","url":"https://api.github.com/users/chiraag-nataraj","html_url":"https://github.com/chiraag-nataraj","followers_url":"https://api.github.com/users/chiraag-nataraj/followers","following_url":"https://api.github.com/users/chiraag-nataraj/following{/other_user}","gists_url":"https://api.github.com/users/chiraag-nataraj/gists{/gist_id}","starred_url":"https://api.github.com/users/chiraag-nataraj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chiraag-nataraj/subscriptions","organizations_url":"https://api.github.com/users/chiraag-nataraj/orgs","repos_url":"https://api.github.com/users/chiraag-nataraj/repos","events_url":"https://api.github.com/users/chiraag-nataraj/events{/privacy}","received_events_url":"https://api.github.com/users/chiraag-nataraj/received_events","type":"User","site_admin":false},"created_at":"2016-12-18T01:08:49Z","updated_at":"2016-12-18T01:08:49Z","body":"@acrobat1 If, indeed, it's a vector for tracking and fingerprinting (and that seems likely), the way to defeat it is most likely by disabling Javascript unless it's needed on a site (e.g. NoScript or uMatrix in block-by-default mode will do the trick)."}}
{"actor":{"display_login":"chiraag-nataraj"}}