5

I need to append parameters to Chromium launch in order to disable SSL v3 due to recent vulnerability refered as Poodle:

--ssl-version-min=tls1

How can I add this parameter in order to:

  • Launch Chromium from the default Unity Launcher/Dash
  • Preserve this setting after Chromium update/upgrade
  • Preserve this setting after Ubuntu update/upgrade

2 Answers 2

9

You need to add this option to the chromium-browser.desktop file, but not the one located in /usr/share/applications/ as this one will be overwritten by package upgrades or release updates.

  1. Open a terminal and copy the /usr/share/applications/chromium-browser.desktop file to your $XDG_DATA_HOME folder:

    cp /usr/share/applications/chromium-browser.desktop ~/.local/share/applications
    
  2. Edit all Exec= commands to append the --ssl-version-min=tls1 option.

    I've found 4 Exec= commands in chromium-browser.desktop:

    $ grep Exec chromium-browser.desktop
    chromium-browser.desktop:Exec=chromium-browser %U
    chromium-browser.desktop:Exec=chromium-browser
    chromium-browser.desktop:Exec=chromium-browser --incognito
    chromium-browser.desktop:Exec=chromium-browser --temp-profile
    

    Use the following command to add the ssl option:

    perl -i -pe 's/(Exec=chromium-browser)/$1 --ssl-version-min=tls1/g' ~/.local/share/applications/chromium-browser.desktop
    

    The Exec commands now look like:

    $ grep Exec chromium-browser.desktop
    chromium-browser.desktop:Exec=chromium-browser --ssl-version-min=tls1 %U
    chromium-browser.desktop:Exec=chromium-browser --ssl-version-min=tls1
    chromium-browser.desktop:Exec=chromium-browser --ssl-version-min=tls1 --incognito
    chromium-browser.desktop:Exec=chromium-browser --ssl-version-min=tls1 --temp-profile
    

Now the .desktop version in your $HOME will always take precedence over the one installed in /usr/share making the change permanent.

Note that you may have to unlock the icon from the launcher and lock it again to select the right .desktop file tough.

To check that the new setting works correctly, type the following command in a terminal:

$ ps -aef | grep ssl-version-min | head -n 1
sylvain   4405  2375  0 11:36 ?        00:00:05 chromium-browser --enable-pinch --ssl-version-min=tls1 

You should see your chromium-browser process and its new command line arguments.

4
  • $XDG_DATA_HOME variable is empty. Does it mean that according to the specification the default value for $XDG_DATA_HOME is $HOME/.local/share? Note the OS is Ubuntu 14.04.
    – g0lem
    Oct 18, 2014 at 10:08
  • @g0lem exactly,it will defaut to $HOME/.local/share. did you try my proposal? Oct 18, 2014 at 11:20
  • @Sylvain_Pineau it works like a charm, thanks. Any specific reason to use perl for inserting content in a text file as shown in your example rather than other Linux command in that case?
    – g0lem
    Oct 18, 2014 at 16:46
  • 1
    @g0lem not really, perl is my favorite swiss-army knife but sed is also possible of course. Oct 18, 2014 at 16:58
1

You can easily do this by adding it /etc/chromium-browser/default

CHROMIUM_FLAGS="--ssl-version-min=tls1"

But modern versions of chromium should be protected against this with insecure versions of SSL removed.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .