make chrome grsec friendly

Dockerfile

@@ -12,7 +12,7 @@ RUN sh -c 'dpkg -i /tmp/google-chrome-stable_current_amd64.deb \
            /tmp/google-talkplugin_current_amd64.deb 2>/dev/null; exit 0' && \
     apt-get update && \
     apt-get -fy install && \
-    apt-get install -y libcanberra-gtk-module libexif12 pulseaudio && \
+    apt-get install -y libcanberra-gtk-module libexif12 pulseaudio paxctl && \
     rm -rf -- /var/lib/apt/lists /tmp/*.deb
 
 # Workaround: pulseaudio client library likes to remove /dev/shm/pulse-shm-*
@@ -21,6 +21,25 @@ RUN sh -c 'dpkg -i /tmp/google-chrome-stable_current_amd64.deb \
 #             in read-only mode when starting the container.
 RUN echo "enable-shm = no" >> /etc/pulse/client.conf
 
+
+# Make Google Chrome grsec friendly
+# more info: https://en.wikibooks.org/wiki/Grsecurity/Application-specific_Settings#Google_Chrome_15.0.874.106
+#
+# To build the Docker image, I currently had to disable the following grsec protections:
+# # grep -E "chroot_deny_chmod|chroot_deny_mknod|chroot_caps" /etc/sysctl.d/grsec.conf
+# kernel.grsecurity.chroot_deny_chmod = 0
+# kernel.grsecurity.chroot_deny_mknod = 0
+# kernel.grsecurity.chroot_caps = 0 (relates to a systemd package)
+#
+# (runtime only, since xattrs are not preserved in Docker's final image)
+# m: Disable MPROTECT // grsec: denied RWX mmap of <anonymous mapping>
+# RUN setfattr -n user.pax.flags -v "m" /opt/google/chrome/chrome
+#
+# (permanent change, by converting the binary headers PT_GNU_STACK into PT_PAX_FLAGS)
+# m: Disable MPROTECT // grsec: denied RWX mmap of <anonymous mapping>
+RUN paxctl -c -v -m /opt/google/chrome/chrome
+
+
 ENV USER user
 ENV GROUPS video,audio
 ENV UID 1000

docker-compose.yml

@@ -24,7 +24,7 @@ services:
       - $HOME/Downloads:/home/user/Downloads
       - /var/run/cups:/var/run/cups:ro
       - /var/run/dbus/system_bus_socket:/var/run/dbus/system_bus_socket:ro
-      # - /tmp/krb5cc_1000:/tmp/krb5cc_1000:ro
+      - /tmp/krb5cc_1000:/tmp/krb5cc_1000:ro
     environment:
       - DISPLAY=unix$DISPLAY
       - PULSE_SERVER=unix:$XDG_RUNTIME_DIR/pulse/native
@@ -32,8 +32,10 @@ services:
       # the ownCloud's (v9.0.0) calendar (v1.0.0.0) does not work correctly
       # the same could happen with Icinga2 web interface
       - TZ=Europe/Amsterdam
+    # SYS_ADMIN is NOT required if you run chrome with `--no-sandbox` flag
+    # more on CAP_SYS_ADMIN https://lwn.net/Articles/486306/
+    cap_add:
+      - SYS_ADMIN
     # security_opt:
       # - apparmor:docker-ptrace
       # - apparmor:unconfined
-    # cap_add:
-      # - SYS_ADMIN