Bdtyktl

I need to append parameters to Chromium launch in order to disable SSL v3 due to recent vulnerability refered as Poodle:

--ssl-version-min=tls1

How can I add this parameter in order to:

• Launch Chromium from the default Unity Launcher/Dash


• Preserve this setting after Chromium update/upgrade


• Preserve this setting after Ubuntu update/upgrade

You need to add this option to the chromium-browser.desktop file, but not the one located in /usr/share/applications/ as this one will be overwritten by package upgrades or release updates.

1. 
   

   Open a terminal and copy the /usr/share/applications/chromium-browser.desktop file to your $XDG_DATA_HOME folder:

   
   
   

   cp /usr/share/applications/chromium-browser.desktop ~/.local/share/applications
   
   

   
   


2. 
   

   Edit all Exec= commands to append the --ssl-version-min=tls1 option.

   
   
   

   I've found 4 Exec= commands in chromium-browser.desktop:

   
   
   

   $ grep Exec chromium-browser.desktop
   
   chromium-browser.desktop:Exec=chromium-browser %U
   
   chromium-browser.desktop:Exec=chromium-browser
   
   chromium-browser.desktop:Exec=chromium-browser --incognito
   
   chromium-browser.desktop:Exec=chromium-browser --temp-profile
   
   

   
   
   

   Use the following command to add the ssl option:

   
   
   

   perl -i -pe 's/(Exec=chromium-browser)/$1 --ssl-version-min=tls1/g' ~/.local/share/applications/chromium-browser.desktop
   
   

   
   
   

   The Exec commands now look like:

   
   
   

   $ grep Exec chromium-browser.desktop
   
   chromium-browser.desktop:Exec=chromium-browser --ssl-version-min=tls1 %U
   
   chromium-browser.desktop:Exec=chromium-browser --ssl-version-min=tls1
   
   chromium-browser.desktop:Exec=chromium-browser --ssl-version-min=tls1 --incognito
   
   chromium-browser.desktop:Exec=chromium-browser --ssl-version-min=tls1 --temp-profile
   
   

   
   

Now the .desktop version in your $HOME will always take precedence over the one installed in /usr/share making the change permanent.

Note that you may have to unlock the icon from the launcher and lock it again to select the right .desktop file tough.

To check that the new setting works correctly, type the following command in a terminal:

$ ps -aef | grep ssl-version-min | head -n 1

sylvain   4405  2375  0 11:36 ?        00:00:05 chromium-browser --enable-pinch --ssl-version-min=tls1 

You should see your chromium-browser process and its new command line arguments.

You can easily do this by adding it /etc/chromium-browser/default

CHROMIUM_FLAGS="--ssl-version-min=tls1"

But modern versions of chromium should be protected against this with insecure versions of SSL removed.