Alright, he's a hacky way I cobbled together (currently if I want a hardened environment, I use Subgraph OS which does all of this in a pretty transparent manner through
Oz, it's still in beta testing but it's likely better tested than my own version, which will need some tweaking) when I run under Arch Linux, first of all it's also done from a grsec/pax kernel to frustrate exploitation and attacks against the kernel.
Update: Adding recommendations beyond Firejail because, frankly, Firejail is janky and unworthy of trust (it fails open, as an example of it's betrayal...).
Update 2: My mistrust in Firejail seems to be vindicated by various vulnerabilties that result in privilege escalation. Luckily, Yawning's sandbox code is now in alpha testing, what it provides can be read here and the code is here. As such I'm removing all firejail documentation.
One of the Tor Developers is working on creating a sandbox for Tor Browser based around a lot of these principles and technologies, except it's going to be better and less hacky than my script below but probably not as extensive as Subgraph or Qubes.
There is Q&A about Yawning's Bubblewrap Tor Browser sandboxing efforts available here and the code for the sandboxing tool is here.
Yawning's code is now released, it creates two sandbox environments. One for Tor Browser and another for the Tor daemon. It handles downloading and verifying the Tor Browser, as well as updating it.
Note that this doesn't address the issues of lateral movement within an X session (any X application can access any other application within the same X session), so you may wish to take extra steps like using
xpra to run a nested X instance to launch the browser inside.
Google also recently gave a talk at a Linux conference about a similar tool they produced to lock down service daemons on Chrome OS, called minijail which also utilises many of the same features of modern Linux kernels.
Arch Linux has a tool called playpen available from the community repos, which works with similar ideas but from inside a chroot, maintained by one of the Copperhead developers.
Other things to consider
- Using a Control Port filter to block the majority of functionality of the control port from Tor Browser.
- Using a nested X instance.
- Using a hardened kernel.
- Using a paravirtualized virtual machine to reduce hardware fingerprinting.