Reorganise the directories.
This commit is contained in:
Alexandre Pujol
parent
91b15fcc73
commit
091d20d086
715 changed files with 0 additions and 0 deletions
222
apparmor.d/groups/browsers/brave
Normal file
222
apparmor.d/groups/browsers/brave
Normal file
|
|
@ -0,0 +1,222 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{BRAVE_INSTALLDIR} = /opt/brave.com/brave{,-beta,-dev}
|
||||
@{BRAVE_HOMEDIR} = @{HOME}/.config/BraveSoftware/Brave-Browser{,-Beta,-Dev}
|
||||
@{BRAVE_CACHEDIR} = @{HOME}/.cache/BraveSoftware/Brave-Browser{,-Beta,-Dev}
|
||||
|
||||
@{exec_path} = @{BRAVE_INSTALLDIR}/brave{,-beta,-dev}
|
||||
profile brave @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/opencl-intel>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/audio>
|
||||
include <abstractions/user-download-strict>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/thumbnails-cache-read>
|
||||
include <abstractions/deny-dconf>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
capability sys_ptrace,
|
||||
|
||||
# The following rules are needed only when the kernel.unprivileged_userns_clone option is set
|
||||
# to "1".
|
||||
capability sys_admin,
|
||||
capability sys_chroot,
|
||||
owner @{PROC}/@{pid}/setgroups w,
|
||||
owner @{PROC}/@{pid}/gid_map w,
|
||||
owner @{PROC}/@{pid}/uid_map w,
|
||||
|
||||
ptrace (read),
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
@{BRAVE_INSTALLDIR}/{,**} r,
|
||||
@{BRAVE_INSTALLDIR}/{brave,chrome}-sandbox rPx,
|
||||
@{BRAVE_INSTALLDIR}/brave-browser{,-beta,-dev} rPx,
|
||||
@{BRAVE_INSTALLDIR}/swiftshader/libGLESv2.so mr,
|
||||
@{BRAVE_INSTALLDIR}/swiftshader/libEGL.so mr,
|
||||
|
||||
# When installing/removing extensions
|
||||
/{usr/,}bin/basename rix,
|
||||
/{usr/,}bin/cut rix,
|
||||
/{usr/,}bin/sed rix,
|
||||
/{usr/,}bin/mkdir rix,
|
||||
/{usr/,}bin/touch rix,
|
||||
/{usr/,}bin/rm rix,
|
||||
/{usr/,}bin/mktemp rix,
|
||||
/{usr/,}bin/cat rix,
|
||||
/{usr/,}bin/{,e}grep rix,
|
||||
|
||||
/etc/opt/chrome/ r,
|
||||
deny /etc/opt/chrome/ w,
|
||||
|
||||
# For "brave --help"
|
||||
/{usr/,}bin/man rPUx,
|
||||
|
||||
# For storing passwords externally
|
||||
/{usr/,}bin/keepassxc-proxy rPUx,
|
||||
|
||||
/{usr/,}bin/lsb_release rPx -> child-lsb_release,
|
||||
|
||||
# no new privs
|
||||
#deny /{usr/,}bin/xdg-desktop-menu rx,
|
||||
|
||||
/{usr/,}bin/xdg-open rCx -> open,
|
||||
/{usr/,}bin/xdg-settings rPUx,
|
||||
/{usr/,}bin/xdg-mime rPUx,
|
||||
|
||||
/usr/share/chromium/extensions/ r,
|
||||
|
||||
# To remove the following error:
|
||||
# Error initializing NSS with a persistent database
|
||||
owner @{HOME}/.pki/ rw,
|
||||
owner @{HOME}/.pki/nssdb/ rw,
|
||||
owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
|
||||
owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
|
||||
owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
owner @{HOME}/.config/BraveSoftware/ w,
|
||||
owner @{BRAVE_HOMEDIR}/ rw,
|
||||
owner @{BRAVE_HOMEDIR}/** rwk,
|
||||
# For Widevine plugin
|
||||
owner @{BRAVE_HOMEDIR}/WidevineCdm/libwidevinecdm.so mrw,
|
||||
|
||||
# Cache files
|
||||
owner @{HOME}/.cache/ rw,
|
||||
owner @{HOME}/.cache/BraveSoftware/ rw,
|
||||
owner @{BRAVE_CACHEDIR}/{,**/} rw,
|
||||
owner @{BRAVE_CACHEDIR}/*/**/{*-,}index rw,
|
||||
owner @{BRAVE_CACHEDIR}/*/**/[a-f0-9]*_? rw,
|
||||
owner @{BRAVE_CACHEDIR}/*/**/todelete_* rw,
|
||||
|
||||
# For importing data (bookmarks, cookies, etc) from Firefox
|
||||
owner @{HOME}/.mozilla/firefox/profiles.ini r,
|
||||
owner @{HOME}/.mozilla/firefox/*/ r,
|
||||
owner @{HOME}/.mozilla/firefox/*/compatibility.ini r,
|
||||
owner @{HOME}/.mozilla/firefox/*/search{,-metadata}.json r,
|
||||
owner @{HOME}/.mozilla/firefox/*/.parentlock rwk,
|
||||
owner @{HOME}/.mozilla/firefox/*/{places,cookies,favicons,formhistory,}.sqlite{,-wal,-shm,-journal} rwk,
|
||||
owner @{HOME}/.mozilla/firefox/*/{cert9,key4}.db rwk,
|
||||
owner @{HOME}/.mozilla/firefox/*/logins.json r,
|
||||
# For importing data from Chromium
|
||||
owner "@{HOME}/.config/chromium/Local State" r,
|
||||
owner @{HOME}/.config/chromium/Singleton{Lock,Socket,Cookie} w,
|
||||
owner "@{HOME}/.config/chromium/*/Login Data{,-journal}" rwk,
|
||||
owner @{HOME}/.config/chromium/*/ r,
|
||||
owner @{HOME}/.config/chromium/*/{History,Cookies,Favicons,Bookmarks} rwk,
|
||||
|
||||
owner @{HOME}/.config/menus/applications-merged/ r,
|
||||
owner @{HOME}/.config/menus/applications-merged/xdg-desktop-menu-dummy.menu r,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
|
||||
# Needed or Brave crash with the following error:
|
||||
# illegal hardware instruction
|
||||
@{PROC}/ r,
|
||||
#
|
||||
deny @{PROC}/vmstat r,
|
||||
deny @{PROC}/stat r,
|
||||
@{PROC}/sys/kernel/yama/ptrace_scope r,
|
||||
@{PROC}/@{pid}/fd/ r,
|
||||
deny @{PROC}/@{pids}/stat r,
|
||||
deny @{PROC}/@{pids}/statm r,
|
||||
# To remove the following error:
|
||||
# Failed to adjust OOM score of renderer with pid : Permission denied
|
||||
deny owner @{PROC}/@{pid}/oom_{,score_}adj rw,
|
||||
#
|
||||
deny @{PROC}/@{pids}/cmdline r,
|
||||
owner @{PROC}/@{pids}/task/ r,
|
||||
deny @{PROC}/@{pids}/task/@{tid}/status r,
|
||||
deny owner @{PROC}/@{pid}/limits r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
owner @{PROC}/@{pid}/clear_refs w,
|
||||
@{PROC}/sys/fs/inotify/max_user_watches r,
|
||||
deny @{PROC}filesystems r,
|
||||
|
||||
owner /dev/shm/.org.chromium.Chromium.* rw,
|
||||
owner /dev/shm/org.chromium.Chromium.shmem.[A-F0-9]*._service_shmem rw,
|
||||
|
||||
/dev/bus/usb/[0-9]*/[0-9]* rw,
|
||||
|
||||
# For downloading files
|
||||
owner @{HOME}/.local/share/.org.chromium.Chromium.* rw,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
# Udev enumeration
|
||||
@{sys}/bus/ r,
|
||||
@{sys}/bus/**/devices/ r,
|
||||
@{sys}/devices/**/uevent r,
|
||||
@{sys}/class/ r,
|
||||
@{sys}/class/**/ r,
|
||||
@{run}/udev/data/* r,
|
||||
@{sys}/devices/pci[0-9]*/**/usb[0-9]/{,**/}{descriptors,manufacturer,product,serial,bConfigurationValue} r,
|
||||
@{sys}/devices/pci[0-9]*/**/usb[0-9]/{,**/}{busnum,devnum} r,
|
||||
|
||||
@{sys}/devices/virtual/tty/tty[0-9]/active r,
|
||||
@{sys}/devices/system/cpu/online r,
|
||||
|
||||
# To remove the following error:
|
||||
# pcilib: Cannot open /sys/bus/pci/devices/0000:03:00.0/irq: Permission denied
|
||||
# The irq file is needed to render pages.
|
||||
@{sys}/devices/pci[0-9]*/**/irq r,
|
||||
|
||||
@{sys}/devices/system/cpu/cpufreq/policy[0-9]/cpuinfo_max_freq r,
|
||||
|
||||
/var/tmp/ r,
|
||||
/tmp/ r,
|
||||
owner /tmp/.org.chromium.Chromium.* rw,
|
||||
owner /tmp/.org.chromium.Chromium.*/{,**} rw,
|
||||
# For installing/updating/removing extensions
|
||||
owner /tmp/scoped_dir*/{,**} rw,
|
||||
owner /tmp/tmp.* rw,
|
||||
# For brave://net-export/
|
||||
owner /tmp/net-export/ rw,
|
||||
|
||||
# Silencer
|
||||
deny @{BRAVE_INSTALLDIR}/** w,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
|
||||
profile open {
|
||||
include <abstractions/base>
|
||||
include <abstractions/xdg-open>
|
||||
|
||||
/{usr/,}bin/xdg-open mr,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/gawk rix,
|
||||
/{usr/,}bin/readlink rix,
|
||||
/{usr/,}bin/basename rix,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
|
||||
owner @{run}/user/[0-9]*/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/brave>
|
||||
}
|
||||
33
apparmor.d/groups/browsers/brave-browser
Normal file
33
apparmor.d/groups/browsers/brave-browser
Normal file
|
|
@ -0,0 +1,33 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
@{BRAVE_INSTALLDIR} = /opt/brave.com/brave{,-beta,-dev}
|
||||
@{BRAVE_HOMEDIR} = @{HOME}/.config/BraveSoftware/Brave-Browser{,-Beta,-Dev}
|
||||
@{BRAVE_CACHEDIR} = @{HOME}/.cache/BraveSoftware/Brave-Browser{,-Beta,-Dev}
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{BRAVE_INSTALLDIR}/brave-browser{,-beta,-dev}
|
||||
profile brave-browser @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
@{exec_path} r,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}bin/readlink rix,
|
||||
/{usr/,}bin/dirname rix,
|
||||
/{usr/,}bin/which rix,
|
||||
/{usr/,}bin/mkdir rix,
|
||||
/{usr/,}bin/cat rix,
|
||||
|
||||
@{BRAVE_INSTALLDIR}/brave rPx,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/63 w,
|
||||
|
||||
include if exists <local/brave-browser>
|
||||
}
|
||||
32
apparmor.d/groups/browsers/brave-sandbox
Normal file
32
apparmor.d/groups/browsers/brave-sandbox
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
@{BRAVE_INSTALLDIR} = /opt/brave.com/brave{,-beta,-dev}
|
||||
@{BRAVE_HOMEDIR} = @{HOME}/.config/BraveSoftware/Brave-Browser{,-Beta,-Dev}
|
||||
@{BRAVE_CACHEDIR} = @{HOME}/.cache/BraveSoftware/Brave-Browser{,-Beta,-Dev}
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = @{BRAVE_INSTALLDIR}/{brave,chrome}-sandbox
|
||||
profile brave-sandbox @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
# For kernel unprivileged user namespaces
|
||||
capability sys_admin,
|
||||
capability sys_chroot,
|
||||
capability setuid,
|
||||
capability setgid,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{BRAVE_INSTALLDIR}/brave rPx,
|
||||
|
||||
@{PROC}/@{pids}/ r,
|
||||
deny owner @{PROC}/@{pid}/oom_{,score_}adj rw,
|
||||
|
||||
include if exists <local/brave-sandbox>
|
||||
}
|
||||
58
apparmor.d/groups/browsers/chromium
Normal file
58
apparmor.d/groups/browsers/chromium
Normal file
|
|
@ -0,0 +1,58 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{CHROMIUM_INSTALLDIR} = /{usr/,}lib/chromium
|
||||
@{CHROMIUM_HOMEDIR} = @{HOME}/.config/chromium
|
||||
@{CHROMIUM_CACHEDIR} = @{HOME}/.cache/chromium
|
||||
|
||||
@{exec_path} = /{usr/,}bin/chromium
|
||||
profile chromium @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
@{exec_path} r,
|
||||
|
||||
@{CHROMIUM_INSTALLDIR}/chromium rPx,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/uname rix,
|
||||
/{usr/,}bin/{,e}grep rix,
|
||||
/{usr/,}bin/expr rix,
|
||||
/{usr/,}bin/cat rix,
|
||||
/{usr/,}bin/rm rix,
|
||||
/{usr/,}bin/cut rix,
|
||||
/{usr/,}bin/tr rix,
|
||||
/{usr/,}bin/ls rix,
|
||||
/{usr/,}bin/mktemp rix,
|
||||
|
||||
# For chromium -g
|
||||
/{usr/,}bin/gdb rPUx,
|
||||
|
||||
owner /tmp/chromiumargs.?????? rw,
|
||||
|
||||
# For a temp profile
|
||||
owner /tmp/tmp.*/ rw,
|
||||
owner /tmp/tmp.*/** rwk,
|
||||
|
||||
# For "chromium --help"
|
||||
/{usr/,}bin/man rPUx,
|
||||
/{usr/,}bin/sed rix,
|
||||
|
||||
/etc/chromium.d/{,*} r,
|
||||
|
||||
/etc/debian_version r,
|
||||
|
||||
/usr/share/chromium/extensions/ r,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty[0-9]* rw,
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
include if exists <local/chromium>
|
||||
}
|
||||
35
apparmor.d/groups/browsers/chromium-chrome-sandbox
Normal file
35
apparmor.d/groups/browsers/chromium-chrome-sandbox
Normal file
|
|
@ -0,0 +1,35 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{CHROMIUM_INSTALLDIR} = /{usr/,}lib/chromium
|
||||
@{CHROMIUM_HOMEDIR} = @{HOME}/.config/chromium
|
||||
@{CHROMIUM_CACHEDIR} = @{HOME}/.cache/chromium
|
||||
|
||||
@{exec_path} = @{CHROMIUM_INSTALLDIR}/chrome-sandbox
|
||||
|
||||
profile chromium-chrome-sandbox @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
# For kernel unprivileged user namespaces
|
||||
capability sys_admin,
|
||||
capability sys_chroot,
|
||||
capability setuid,
|
||||
capability setgid,
|
||||
|
||||
# optional
|
||||
capability sys_resource,
|
||||
|
||||
@{exec_path} mr,
|
||||
@{CHROMIUM_INSTALLDIR}/chromium rPx,
|
||||
|
||||
@{PROC}/@{pids}/ r,
|
||||
deny owner @{PROC}/@{pid}/oom_{,score_}adj rw,
|
||||
|
||||
include if exists <local/chromium-chrome-sandbox>
|
||||
}
|
||||
211
apparmor.d/groups/browsers/chromium-chromium
Normal file
211
apparmor.d/groups/browsers/chromium-chromium
Normal file
|
|
@ -0,0 +1,211 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{CHROMIUM_INSTALLDIR} = /{usr/,}lib/chromium
|
||||
@{CHROMIUM_HOMEDIR} = @{HOME}/.config/chromium
|
||||
@{CHROMIUM_CACHEDIR} = @{HOME}/.cache/chromium
|
||||
|
||||
@{exec_path} = @{CHROMIUM_INSTALLDIR}/chromium
|
||||
profile chromium-chromium @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/opencl-intel>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/audio>
|
||||
include <abstractions/user-download-strict>
|
||||
include <abstractions/thumbnails-cache-read>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/deny-dconf>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
# The following rules are needed only when the kernel.unprivileged_userns_clone option is set
|
||||
# to "1".
|
||||
capability sys_admin,
|
||||
capability sys_chroot,
|
||||
owner @{PROC}/@{pid}/setgroups w,
|
||||
owner @{PROC}/@{pid}/gid_map w,
|
||||
owner @{PROC}/@{pid}/uid_map w,
|
||||
|
||||
ptrace (trace) peer=@{profile_name},
|
||||
ptrace (read) peer=xdg-settings,
|
||||
ptrace (read) peer=keepassxc-proxy,
|
||||
ptrace (read) peer=child-lsb_release,
|
||||
|
||||
signal (send) set=(term, kill) peer=keepassxc-proxy,
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
@{CHROMIUM_INSTALLDIR}/chrome-sandbox rPx,
|
||||
|
||||
# For storing passwords externally
|
||||
/{usr/,}bin/keepassxc-proxy rPUx,
|
||||
|
||||
/{usr/,}bin/lsb_release rPx -> child-lsb_release,
|
||||
/{usr/,}bin/xdg-mime rPUx,
|
||||
/{usr/,}bin/xdg-open rCx -> open,
|
||||
/{usr/,}bin/xdg-settings rPUx,
|
||||
/{usr/,}bin/xdg-desktop-menu rPUx,
|
||||
/{usr/,}bin/xdg-icon-resource rPUx,
|
||||
|
||||
# To remove the following error:
|
||||
# Error initializing NSS with a persistent database
|
||||
owner @{HOME}/.pki/ rw,
|
||||
owner @{HOME}/.pki/nssdb/ rw,
|
||||
owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
|
||||
owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
|
||||
owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
|
||||
|
||||
# Chromium files
|
||||
/usr/share/chromium/{,**} r,
|
||||
|
||||
# Chrome extensions (for Debian)
|
||||
/usr/share/webext/{,**} r,
|
||||
|
||||
/usr/share/mozilla/extensions/{,**} r,
|
||||
|
||||
/etc/chromium/ r,
|
||||
/etc/chromium/master_preferences r,
|
||||
|
||||
# Chromium home files
|
||||
owner @{HOME}/ r,
|
||||
owner @{HOME}/.config/ r,
|
||||
owner @{CHROMIUM_HOMEDIR}/ rw,
|
||||
owner @{CHROMIUM_HOMEDIR}/** rwk,
|
||||
owner @{CHROMIUM_HOMEDIR}/WidevineCdm/*/_platform_specific/linux_*/libwidevinecdm.so mrw,
|
||||
|
||||
owner @{HOME}/.local/share/.org.chromium.Chromium.* rw,
|
||||
|
||||
# Cache files
|
||||
owner @{HOME}/.cache/ rw,
|
||||
owner @{CHROMIUM_CACHEDIR}/{,**/} rw,
|
||||
owner @{CHROMIUM_CACHEDIR}/*/**/{*-,}index rw,
|
||||
owner @{CHROMIUM_CACHEDIR}/*/**/[a-f0-9]*_? rw,
|
||||
owner @{CHROMIUM_CACHEDIR}/*/**/todelete_* rw,
|
||||
|
||||
# For importing data (bookmarks, cookies, etc) from Firefox
|
||||
owner @{HOME}/.mozilla/firefox/profiles.ini r,
|
||||
owner @{HOME}/.mozilla/firefox/*/ r,
|
||||
owner @{HOME}/.mozilla/firefox/*/compatibility.ini r,
|
||||
owner @{HOME}/.mozilla/firefox/*/search{,-metadata}.json r,
|
||||
owner @{HOME}/.mozilla/firefox/*/.parentlock rwk,
|
||||
owner @{HOME}/.mozilla/firefox/*/{places,cookies,favicons,formhistory,}.sqlite{,-wal,-shm,-journal} rwk,
|
||||
owner @{HOME}/.mozilla/firefox/*/{cert9,key4}.db rwk,
|
||||
owner @{HOME}/.mozilla/firefox/*/logins.json r,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
|
||||
# Needed or chromium gets crash with the following error:
|
||||
# FATAL:sandbox_linux.cc(172)] Check failed: proc_fd_ >= 0 (-1 vs. 0)
|
||||
@{PROC}/ r,
|
||||
#
|
||||
deny @{PROC}/vmstat r,
|
||||
@{PROC}/sys/kernel/yama/ptrace_scope r,
|
||||
@{PROC}/@{pid}/fd/ r,
|
||||
deny @{PROC}/@{pids}/stat r,
|
||||
deny @{PROC}/@{pids}/statm r,
|
||||
# To remove the following error:
|
||||
# Failed to adjust OOM score of renderer with pid : Permission denied
|
||||
deny owner @{PROC}/@{pid}/oom_{,score_}adj rw,
|
||||
#
|
||||
deny @{PROC}/@{pids}/cmdline r,
|
||||
deny owner @{PROC}/@{pids}/environ r,
|
||||
owner @{PROC}/@{pids}/task/ r,
|
||||
deny @{PROC}/@{pids}/task/@{tid}/stat r,
|
||||
deny @{PROC}/@{pids}/task/@{tid}/status r,
|
||||
deny owner @{PROC}/@{pid}/limits r,
|
||||
deny owner @{PROC}/@{pid}/mem r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
# To remove the following error:
|
||||
# file_path_watcher_linux.cc(71)] Failed to read /proc/sys/fs/inotify/max_user_watches
|
||||
@{PROC}/sys/fs/inotify/max_user_watches r,
|
||||
|
||||
deny /dev/shm/ r,
|
||||
owner /dev/shm/.org.chromium.Chromium.* rw,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
# Udev enumeration
|
||||
@{sys}/bus/ r,
|
||||
@{sys}/bus/**/devices/ r,
|
||||
@{sys}/devices/**/uevent r,
|
||||
@{sys}/class/ r,
|
||||
@{sys}/class/**/ r,
|
||||
@{run}/udev/data/* r,
|
||||
@{sys}/devices/pci[0-9]*/**/usb[0-9]/{,**/}{descriptors,manufacturer,product,serial,bConfigurationValue} r,
|
||||
@{sys}/devices/pci[0-9]*/**/usb[0-9]/{,**/}{busnum,devnum} r,
|
||||
|
||||
deny @{sys}/devices/virtual/tty/tty[0-9]/active r,
|
||||
|
||||
@{sys}/devices/virtual/dmi/id/sys_vendor r,
|
||||
@{sys}/devices/virtual/dmi/id/product_name r,
|
||||
@{sys}/devices/system/cpu/cpufreq/policy[0-9]*/cpuinfo_max_freq r,
|
||||
|
||||
# To remove the following error:
|
||||
# pcilib: Cannot open /sys/bus/pci/devices/0000:03:00.0/irq: Permission denied
|
||||
# The irq file is needed to render pages.
|
||||
@{sys}/devices/pci[0-9]*/**/irq r,
|
||||
|
||||
/var/tmp/ r,
|
||||
/tmp/ r,
|
||||
owner /tmp/.org.chromium.Chromium.* rw,
|
||||
owner /tmp/.org.chromium.Chromium.*/{,**} rw,
|
||||
|
||||
# For the temp profile
|
||||
owner /tmp/tmp.*/ rw,
|
||||
owner /tmp/tmp.*/** rwk,
|
||||
|
||||
# For installing/updating extensions
|
||||
owner /tmp/scoped_dir*/ rw,
|
||||
owner /tmp/scoped_dir*/** rw,
|
||||
|
||||
# Silencer
|
||||
deny @{CHROMIUM_INSTALLDIR}/** w,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty[0-9]* rw,
|
||||
|
||||
|
||||
profile open {
|
||||
include <abstractions/base>
|
||||
include <abstractions/xdg-open>
|
||||
|
||||
/{usr/,}bin/xdg-open mr,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/gawk rix,
|
||||
/{usr/,}bin/readlink rix,
|
||||
/{usr/,}bin/basename rix,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
|
||||
owner @{run}/user/[0-9]*/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
/{usr/,}bin/smplayer rPx,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/chromium-chromium>
|
||||
}
|
||||
227
apparmor.d/groups/browsers/firefox
Normal file
227
apparmor.d/groups/browsers/firefox
Normal file
|
|
@ -0,0 +1,227 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2015-2020 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{MOZ_LIBDIR} = /{usr/,}lib/firefox{,-esr}
|
||||
@{MOZ_HOMEDIR} = @{HOME}/.mozilla
|
||||
@{MOZ_CACHEDIR} = @{HOME}/.cache/mozilla
|
||||
|
||||
@{exec_path} = @{MOZ_LIBDIR}/firefox{,-bin,-esr}
|
||||
profile firefox @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/wayland>
|
||||
include <abstractions/opencl-intel>
|
||||
include <abstractions/vulkan>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/audio>
|
||||
include <abstractions/enchant>
|
||||
include <abstractions/user-download-strict>
|
||||
include <abstractions/thumbnails-cache-read>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/deny-dconf>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
##include <abstractions/nvidia>
|
||||
|
||||
ptrace peer=@{profile_name},
|
||||
|
||||
signal (send) set=(term, kill) peer=keepassxc-proxy,
|
||||
signal (send) set=(term, kill) peer=firefox-*,
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
# The following rules are needed only when the kernel.unprivileged_userns_clone option is set
|
||||
# to "1".
|
||||
capability sys_admin,
|
||||
capability sys_chroot,
|
||||
owner @{PROC}/@{pid}/setgroups w,
|
||||
owner @{PROC}/@{pid}/gid_map w,
|
||||
owner @{PROC}/@{pid}/uid_map w,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
# Firefox files
|
||||
@{MOZ_LIBDIR}/{,**} r,
|
||||
@{MOZ_LIBDIR}/*.so mr,
|
||||
@{MOZ_LIBDIR}/crashreporter rPx,
|
||||
@{MOZ_LIBDIR}/minidump-analyzer rPx,
|
||||
#@{MOZ_LIBDIR}/pingsender rPx,
|
||||
#@{MOZ_LIBDIR}/plugin-container rPx,
|
||||
/usr/share/firefox/{,**} r,
|
||||
/etc/firefox/{,**} r,
|
||||
|
||||
# Firefox plugins & extensions
|
||||
/{usr/,}lib/mozilla/plugins/ r,
|
||||
/{usr/,}lib/mozilla/plugins/libvlcplugin.so mr,
|
||||
/usr/share/mozilla/extensions/{,**} r,
|
||||
/usr/share/webext/{,**} r,
|
||||
|
||||
# To be able to read docs
|
||||
/usr/share/doc/{,**} r,
|
||||
|
||||
# Firefox home files
|
||||
owner @{MOZ_HOMEDIR}/ rw,
|
||||
owner @{MOZ_HOMEDIR}/{extensions,systemextensionsdev}/ rw,
|
||||
owner @{MOZ_HOMEDIR}/firefox/ rw,
|
||||
owner @{MOZ_HOMEDIR}/firefox/installs.ini rw,
|
||||
owner @{MOZ_HOMEDIR}/firefox/profiles.ini rw,
|
||||
owner @{MOZ_HOMEDIR}/firefox/*/ rw,
|
||||
owner @{MOZ_HOMEDIR}/firefox/*/** rwk,
|
||||
# For keepassxc integration
|
||||
owner @{MOZ_HOMEDIR}/native-messaging-hosts/org.keepassxc.keepassxc_browser.json r,
|
||||
|
||||
# Cache
|
||||
owner @{HOME}/.cache/ rw,
|
||||
owner @{MOZ_CACHEDIR}/ rw,
|
||||
owner @{MOZ_CACHEDIR}/** rwk,
|
||||
|
||||
owner @{HOME}/.cache/gstreamer-[0-9]*/ rw,
|
||||
owner @{HOME}/.cache/gstreamer-[0-9]*/registry.*.bin{,.tmp*} rw,
|
||||
|
||||
deny @{sys}/devices/system/cpu/present r,
|
||||
deny @{sys}/devices/system/cpu/cpufreq/policy[0-9]/cpuinfo_max_freq r,
|
||||
deny @{sys}/devices/system/cpu/cpu[0-9]/cache/index[0-9]/size r,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
owner @{PROC}/@{pid}/cgroup r,
|
||||
deny owner @{PROC}/@{pid}/stat r,
|
||||
deny owner @{PROC}/@{pids}/cmdline r,
|
||||
deny owner @{PROC}/@{pids}/environ r,
|
||||
owner @{PROC}/@{pid}/task/ r,
|
||||
deny owner @{PROC}/@{pid}/task/@{tid}/stat r,
|
||||
# To remove the following error:
|
||||
# GLib-GIO-WARNING **: Error creating IO channel for /proc/self/mountinfo: Permission denied
|
||||
# (g-file-error-quark, 2)
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
# About:memory
|
||||
deny owner @{PROC}/@{pid}/statm r,
|
||||
deny owner @{PROC}/@{pid}/smaps r,
|
||||
# Link Monitor (since 49.0.1)
|
||||
@{PROC}/@{pid}/net/arp r,
|
||||
@{PROC}/@{pid}/net/route r,
|
||||
#
|
||||
@{PROC}/@{pid}/net/if_inet6 r,
|
||||
|
||||
/etc/mime.types r,
|
||||
/etc/mailcap r,
|
||||
|
||||
# Set default browser
|
||||
/{usr/,}bin/update-mime-database rPUx,
|
||||
owner @{HOME}/.config/mimeapps.list{,.*} rw,
|
||||
owner @{HOME}/.local/share/mime/packages/user-extension-{htm,html,xht,xhtml,shtml}.xml rw,
|
||||
owner @{HOME}/.local/share/mime/packages/user-extension-{htm,html,xht,xhtml,shtml}.xml.* rw,
|
||||
|
||||
# KDE system keyring
|
||||
/{usr/,}lib/@{multiarch}/qt5/plugins/kf5/org.kde.kwindowsystem.platforms/KF5WindowSystemX11Plugin.so mr,
|
||||
/usr/share/xul-ext/kwallet5/* r,
|
||||
/etc/xul-ext/kwallet5.js r,
|
||||
|
||||
# For wayland
|
||||
owner /dev/shm/wayland.mozilla.ipc.[0-9]* rw,
|
||||
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
/var/tmp/ r,
|
||||
/tmp/ r,
|
||||
owner /tmp/* rw,
|
||||
owner /tmp/firefox_*/ rw,
|
||||
owner /tmp/firefox_*/* rwk,
|
||||
owner /tmp/firefox/ rw,
|
||||
owner /tmp/firefox/* rwk,
|
||||
owner /tmp/mozilla_*/ rw,
|
||||
owner /tmp/mozilla_*/* rw,
|
||||
owner /tmp/Temp-*/ rw,
|
||||
|
||||
deny /dev/ r,
|
||||
deny /dev/shm/ r,
|
||||
owner /dev/shm/org.chromium.* rw,
|
||||
owner /dev/shm/org.mozilla.ipc.@{pid}.[0-9]* rw,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
# Silencer
|
||||
deny /{usr/,}lib/firefox/** w,
|
||||
|
||||
/{usr/,}bin/gpa rPUx,
|
||||
/{usr/,}bin/keepassxc-proxy rPUx, # For storing passwords externally
|
||||
|
||||
/{usr/,}bin/lsb_release rPx -> child-lsb_release,
|
||||
|
||||
/{usr/,}bin/xdg-open rCx -> open,
|
||||
/{usr/,}bin/exo-open rCx -> open,
|
||||
/{usr/,}lib/@{multiarch}/glib-[0-9]*/gio-launch-desktop rCx -> open,
|
||||
|
||||
# Allowed apps to open
|
||||
/{usr/,}bin/vlc rPx,
|
||||
/{usr/,}bin/qbittorrent rPx,
|
||||
/{usr/,}bin/smplayer rPx,
|
||||
/{usr/,}bin/geany rPx,
|
||||
/{usr/,}bin/okular rPx,
|
||||
/{usr/,}bin/viewnior rPUx,
|
||||
/{usr/,}bin/xarchiver rPx,
|
||||
/{usr/,}bin/engrampa rPx,
|
||||
/{usr/,}bin/thunderbird rPx,
|
||||
/{usr/,}bin/telegram-desktop rPx,
|
||||
/{usr/,}bin/spacefm rPx,
|
||||
/{usr/,}bin/qpdfview rPx,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty[0-9]* rw,
|
||||
|
||||
|
||||
profile open {
|
||||
include <abstractions/base>
|
||||
include <abstractions/xdg-open>
|
||||
|
||||
/{usr/,}bin/xdg-open mr,
|
||||
/{usr/,}bin/exo-open mr,
|
||||
/{usr/,}lib/@{multiarch}/glib-[0-9]*/gio-launch-desktop mr,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/gawk rix,
|
||||
/{usr/,}bin/readlink rix,
|
||||
/{usr/,}bin/basename rix,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
|
||||
owner @{run}/user/[0-9]*/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
/{usr/,}bin/vlc rPx,
|
||||
/{usr/,}bin/qbittorrent rPx,
|
||||
/{usr/,}bin/smplayer rPx,
|
||||
/{usr/,}bin/geany rPx,
|
||||
/{usr/,}bin/okular rPx,
|
||||
/{usr/,}bin/viewnior rPUx,
|
||||
/{usr/,}bin/xarchiver rPx,
|
||||
/{usr/,}bin/engrampa rPx,
|
||||
/{usr/,}bin/thunderbird rPx,
|
||||
/{usr/,}bin/telegram-desktop rPx,
|
||||
/{usr/,}bin/spacefm rPx,
|
||||
/{usr/,}bin/qpdfview rPx,
|
||||
/usr/share/xfce4/exo/exo-compose-mail rPx,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/firefox>
|
||||
}
|
||||
69
apparmor.d/groups/browsers/firefox-crashreporter
Normal file
69
apparmor.d/groups/browsers/firefox-crashreporter
Normal file
|
|
@ -0,0 +1,69 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{MOZ_LIBDIR} = /{usr/,}lib/firefox
|
||||
@{MOZ_HOMEDIR} = @{HOME}/.mozilla
|
||||
@{MOZ_CACHEDIR} = @{HOME}/.cache/mozilla
|
||||
|
||||
@{exec_path} = @{MOZ_LIBDIR}/crashreporter
|
||||
profile firefox-crashreporter @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/wayland>
|
||||
include <abstractions/nameservice>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/openssl>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
include <abstractions/deny-dconf>
|
||||
|
||||
signal (receive) set=(term, kill) peer=firefox,
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{MOZ_LIBDIR}/minidump-analyzer rPx,
|
||||
|
||||
/{usr/,}bin/mv rix,
|
||||
|
||||
owner "@{MOZ_HOMEDIR}/firefox/Crash Reports/{,**}" rw,
|
||||
owner "@{MOZ_HOMEDIR}/firefox/Crash Reports/crashreporter.ini" rw,
|
||||
owner "@{MOZ_HOMEDIR}/firefox/Crash Reports/submit.log" rw,
|
||||
owner "@{MOZ_HOMEDIR}/firefox/Crash Reports/events/[0-9a-f]*" rw,
|
||||
owner "@{MOZ_HOMEDIR}/firefox/Crash Reports/pending/[0-9a-f]*.{dmp,extra}" rw,
|
||||
|
||||
owner @{MOZ_HOMEDIR}/firefox/*.*/minidumps/{,**} rw,
|
||||
owner @{MOZ_HOMEDIR}/firefox/*.*/minidumps/[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*.{dmp,extra} rw,
|
||||
|
||||
owner @{MOZ_HOMEDIR}/firefox/*.*/crashes/{,**} rw,
|
||||
owner @{MOZ_HOMEDIR}/firefox/*.*/crashes/events/[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* rw,
|
||||
|
||||
/tmp/ r,
|
||||
owner /tmp/[0-9a-f]*.{dmp,extra} rw,
|
||||
owner /tmp/firefox/.parentlock w,
|
||||
/var/tmp/ r,
|
||||
|
||||
owner /dev/shm/org.mozilla.ipc.[0-9]*.[0-9]* r,
|
||||
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
|
||||
/usr/share/X11/xkb/** r,
|
||||
|
||||
# file_inherit
|
||||
owner @{MOZ_CACHEDIR}/firefox/*.*/** r,
|
||||
owner @{MOZ_HOMEDIR}/firefox/*.*/extensions/*.xpi r,
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
/dev/dri/renderD128 rw,
|
||||
|
||||
include if exists <local/firefox-crashreporter>
|
||||
}
|
||||
41
apparmor.d/groups/browsers/firefox-minidump-analyzer
Normal file
41
apparmor.d/groups/browsers/firefox-minidump-analyzer
Normal file
|
|
@ -0,0 +1,41 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{MOZ_LIBDIR} = /{usr/,}lib/firefox
|
||||
@{MOZ_HOMEDIR} = @{HOME}/.mozilla
|
||||
@{MOZ_CACHEDIR} = @{HOME}/.cache/mozilla
|
||||
|
||||
@{exec_path} = /{usr/,}lib/firefox/minidump-analyzer
|
||||
profile firefox-minidump-analyzer @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
signal (receive) set=(term, kill) peer=firefox,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner /tmp/[0-9a-f]*.{dmp,extra} rw,
|
||||
owner /tmp/firefox/.parentlock w,
|
||||
|
||||
owner "@{MOZ_HOMEDIR}/firefox/Crash Reports/" rw,
|
||||
owner "@{MOZ_HOMEDIR}/firefox/Crash Reports/pending/" rw,
|
||||
owner "@{MOZ_HOMEDIR}/firefox/Crash Reports/pending/[0-9a-f]*.{dmp,extra}" rw,
|
||||
|
||||
owner @{MOZ_HOMEDIR}/firefox/*.*/minidumps/ rw,
|
||||
owner @{MOZ_HOMEDIR}/firefox/*.*/minidumps/[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*.{dmp,extra} rw,
|
||||
|
||||
owner /dev/shm/org.mozilla.ipc.[0-9]*.[0-9]* r,
|
||||
|
||||
# file_inherit
|
||||
owner @{MOZ_CACHEDIR}/firefox/*.*/startupCache/*Cache* r,
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
owner @{HOME}/.mozilla/firefox/m-oyw579q8.default/extensions/*.xpi r,
|
||||
/dev/dri/renderD128 rw,
|
||||
|
||||
include if exists <local/firefox-minidump-analyzer>
|
||||
}
|
||||
31
apparmor.d/groups/browsers/firefox-pingsender
Normal file
31
apparmor.d/groups/browsers/firefox-pingsender
Normal file
|
|
@ -0,0 +1,31 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2020-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{MOZ_LIBDIR} = /{usr/,}lib/firefox
|
||||
@{MOZ_HOMEDIR} = @{HOME}/.mozilla
|
||||
@{MOZ_CACHEDIR} = @{HOME}/.cache/mozilla
|
||||
|
||||
@{exec_path} = @{MOZ_LIBDIR}/pingsender
|
||||
profile firefox-pingsender @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/openssl>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
signal (receive) set=(term, kill) peer=firefox,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{HOME}/.mozilla/firefox/*.*/saved-telemetry-pings/[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* rw,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty[0-9]* rw,
|
||||
|
||||
include if exists <local/firefox-pingsender>
|
||||
}
|
||||
22
apparmor.d/groups/browsers/firefox-plugin-container
Normal file
22
apparmor.d/groups/browsers/firefox-plugin-container
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2020-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{MOZ_LIBDIR} = /{usr/,}lib/firefox{,-esr}
|
||||
@{MOZ_HOMEDIR} = @{HOME}/.mozilla
|
||||
@{MOZ_CACHEDIR} = @{HOME}/.cache/mozilla
|
||||
|
||||
@{exec_path} = @{MOZ_LIBDIR}/plugin-container
|
||||
profile firefox-plugin-container @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
signal (receive) set=(term, kill) peer=firefox,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
include if exists <local/firefox-plugin-container>
|
||||
}
|
||||
205
apparmor.d/groups/browsers/google-chrome-chrome
Normal file
205
apparmor.d/groups/browsers/google-chrome-chrome
Normal file
|
|
@ -0,0 +1,205 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{CHROME_INSTALLDIR} = /opt/google/chrome{,-beta,-unstable}
|
||||
@{CHROME_HOMEDIR} = @{HOME}/.config/google-chrome{,-beta,-unstable}
|
||||
@{CHROME_CACHEDIR} = @{HOME}/.cache/google-chrome{,-beta,-unstable}
|
||||
|
||||
@{exec_path} = @{CHROME_INSTALLDIR}/chrome{,-beta,-unstable}
|
||||
profile google-chrome-chrome @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/opencl-intel>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/audio>
|
||||
include <abstractions/user-download-strict>
|
||||
include <abstractions/thumbnails-cache-read>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
# The following rules are needed only when the kernel.unprivileged_userns_clone option is set
|
||||
# to "1".
|
||||
capability sys_admin,
|
||||
capability sys_chroot,
|
||||
owner @{PROC}/@{pid}/setgroups w,
|
||||
owner @{PROC}/@{pid}/gid_map w,
|
||||
owner @{PROC}/@{pid}/uid_map w,
|
||||
|
||||
ptrace (trace) peer=@{profile_name},
|
||||
|
||||
signal (send) set=(term, kill) peer=keepassxc-proxy,
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
@{CHROME_INSTALLDIR}/{,**} r,
|
||||
@{CHROME_INSTALLDIR}/chrome-sandbox rPx,
|
||||
@{CHROME_INSTALLDIR}/google-chrome{,-beta,-unstable} rPx,
|
||||
@{CHROME_INSTALLDIR}/nacl_helper rix,
|
||||
@{CHROME_INSTALLDIR}/xdg-mime rix,
|
||||
@{CHROME_INSTALLDIR}/xdg-settings rix,
|
||||
|
||||
# For "google-chrome --help"
|
||||
/{usr/,}bin/man rPUx,
|
||||
|
||||
# For storing passwords externally
|
||||
/{usr/,}bin/keepassxc-proxy rPUx,
|
||||
|
||||
/{usr/,}bin/lsb_release rPx -> child-lsb_release,
|
||||
/{usr/,}bin/xdg-open rCx -> open,
|
||||
|
||||
# no new privs
|
||||
deny /{usr/,}bin/xdg-desktop-menu rx,
|
||||
deny /{usr/,}bin/xdg-icon-resource rx,
|
||||
|
||||
/{usr/,}bin/xdg-mime rPUx,
|
||||
/{usr/,}bin/xdg-settings rPUx,
|
||||
|
||||
# To remove the following error:
|
||||
# Error initializing NSS with a persistent database
|
||||
owner @{HOME}/.pki/ rw,
|
||||
owner @{HOME}/.pki/nssdb/ rw,
|
||||
owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
|
||||
owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
|
||||
owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
|
||||
|
||||
# Google Chrome home files
|
||||
owner @{HOME}/ r,
|
||||
owner @{CHROME_HOMEDIR}/ rw,
|
||||
owner @{CHROME_HOMEDIR}/** rwk,
|
||||
# Flashplayer
|
||||
owner @{CHROME_HOMEDIR}/PepperFlash/**/libpepflashplayer.so mr,
|
||||
|
||||
owner @{HOME}/.local/share/.com.google.Chrome.* rw,
|
||||
|
||||
# Cache files
|
||||
owner @{HOME}/.cache/ rw,
|
||||
owner @{CHROME_CACHEDIR}/{,**/} rw,
|
||||
owner @{CHROME_CACHEDIR}/*/**/{*-,}index rw,
|
||||
owner @{CHROME_CACHEDIR}/*/**/[a-f0-9]*_? rw,
|
||||
owner @{CHROME_CACHEDIR}/*/**/todelete_* rw,
|
||||
|
||||
# To remove browser history/cache
|
||||
owner @{CHROME_CACHEDIR}/PnaclTranslationCache/index rw,
|
||||
owner @{CHROME_CACHEDIR}/PnaclTranslationCache/data_[0-9]*[0-9] rw,
|
||||
|
||||
# For importing data (bookmarks, cookies, etc) from Firefox
|
||||
owner @{HOME}/.mozilla/firefox/profiles.ini r,
|
||||
owner @{HOME}/.mozilla/firefox/*/ r,
|
||||
owner @{HOME}/.mozilla/firefox/*/compatibility.ini r,
|
||||
owner @{HOME}/.mozilla/firefox/*/search{,-metadata}.json r,
|
||||
owner @{HOME}/.mozilla/firefox/*/.parentlock rwk,
|
||||
owner @{HOME}/.mozilla/firefox/*/{places,cookies,favicons,formhistory,}.sqlite{,-wal,-shm,-journal} rwk,
|
||||
owner @{HOME}/.mozilla/firefox/*/{cert9,key4}.db rwk,
|
||||
owner @{HOME}/.mozilla/firefox/*/logins.json r,
|
||||
# For importing data from Chromium
|
||||
owner "@{HOME}/.config/chromium/Local State" r,
|
||||
owner @{HOME}/.config/chromium/Singleton{Lock,Socket,Cookie} w,
|
||||
owner "@{HOME}/.config/chromium/*/Login Data{,-journal}" rwk,
|
||||
owner @{HOME}/.config/chromium/*/ r,
|
||||
owner @{HOME}/.config/chromium/*/{History,Cookies,Favicons,Bookmarks} rwk,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
|
||||
# Needed or Google Chrome crash with the following error:
|
||||
# illegal hardware instruction
|
||||
@{PROC}/ r,
|
||||
#
|
||||
deny @{PROC}/vmstat r,
|
||||
@{PROC}/sys/kernel/yama/ptrace_scope r,
|
||||
@{PROC}/@{pid}/fd/ r,
|
||||
deny @{PROC}/@{pids}/stat r,
|
||||
deny @{PROC}/@{pids}/statm r,
|
||||
# To remove the following error:
|
||||
# Failed to adjust OOM score of renderer with pid : Permission denied
|
||||
deny owner @{PROC}/@{pid}/oom_{,score_}adj rw,
|
||||
#
|
||||
deny @{PROC}/@{pids}/cmdline r,
|
||||
deny owner @{PROC}/@{pids}/environ r,
|
||||
owner @{PROC}/@{pid}/task/ r,
|
||||
deny @{PROC}/@{pids}/task/@{tid}/stat r,
|
||||
deny @{PROC}/@{pids}/task/@{tid}/status r,
|
||||
deny owner @{PROC}/@{pid}/limits r,
|
||||
deny owner @{PROC}/@{pid}/mem r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
deny @{PROC}/diskstats r,
|
||||
|
||||
owner /dev/shm/.com.google.Chrome.* rw,
|
||||
|
||||
# To play DRM media (protected content)
|
||||
@{CHROME_INSTALLDIR}/libwidevinecdm.so mr,
|
||||
@{CHROME_INSTALLDIR}/libwidevinecdmadapter.so mr,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
# Udev enumeration
|
||||
@{sys}/bus/ r,
|
||||
@{sys}/bus/**/devices/ r,
|
||||
@{sys}/devices/**/uevent r,
|
||||
@{sys}/class/ r,
|
||||
@{sys}/class/**/ r,
|
||||
@{run}/udev/data/* r,
|
||||
@{sys}/devices/pci[0-9]*/**/usb[0-9]/{,**/}{descriptors,manufacturer,product,serial,bConfigurationValue} r,
|
||||
@{sys}/devices/pci[0-9]*/**/usb[0-9]/{,**/}{busnum,devnum} r,
|
||||
|
||||
deny @{sys}/devices/virtual/tty/tty[0-9]/active r,
|
||||
deny @{sys}/devices/system/cpu/cpufreq/policy[0-9]/cpuinfo_max_freq r,
|
||||
|
||||
# To remove the following error:
|
||||
# pcilib: Cannot open /sys/bus/pci/devices/0000:03:00.0/irq: Permission denied
|
||||
# The irq file is needed to render pages.
|
||||
@{sys}/devices/pci[0-9]*/**/irq r,
|
||||
|
||||
/var/tmp/ r,
|
||||
/tmp/ r,
|
||||
owner /tmp/.com.google.Chrome.* rw,
|
||||
owner /tmp/.com.google.Chrome.*/{,**} rw,
|
||||
# For installing/updating extensions
|
||||
owner /tmp/scoped_dir*/{,**} rw,
|
||||
|
||||
# Silencer
|
||||
deny @{CHROME_INSTALLDIR}/** w,
|
||||
|
||||
|
||||
profile open {
|
||||
include <abstractions/base>
|
||||
include <abstractions/xdg-open>
|
||||
|
||||
/{usr/,}bin/xdg-open mr,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/gawk rix,
|
||||
/{usr/,}bin/readlink rix,
|
||||
/{usr/,}bin/basename rix,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
|
||||
owner @{run}/user/[0-9]*/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/google-chrome-chrome>
|
||||
}
|
||||
39
apparmor.d/groups/browsers/google-chrome-chrome-sandbox
Normal file
39
apparmor.d/groups/browsers/google-chrome-chrome-sandbox
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{CHROME_INSTALLDIR} = /opt/google/chrome{,-beta,-unstable}
|
||||
@{CHROME_HOMEDIR} = @{HOME}/.config/google-chrome{,-beta,-unstable}
|
||||
@{CHROME_CACHEDIR} = @{HOME}/.cache/google-chrome{,-beta,-unstable}
|
||||
|
||||
@{exec_path} = @{CHROME_INSTALLDIR}/chrome-sandbox
|
||||
profile google-chrome-chrome-sandbox @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
# For kernel unprivileged user namespaces
|
||||
capability sys_admin,
|
||||
capability sys_chroot,
|
||||
capability setuid,
|
||||
capability setgid,
|
||||
|
||||
# optional
|
||||
capability sys_resource,
|
||||
|
||||
@{exec_path} mr,
|
||||
@{CHROME_INSTALLDIR}/chrome rPx,
|
||||
@{CHROME_INSTALLDIR}/nacl_helper rix,
|
||||
|
||||
deny @{sys}/devices/system/cpu/cpufreq/policy[0-9]/cpuinfo_max_freq r,
|
||||
|
||||
@{PROC} r,
|
||||
@{PROC}/@{pids}/ r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
deny owner @{PROC}/@{pid}/oom_{,score_}adj rw,
|
||||
|
||||
include if exists <local/google-chrome-chrome-sandbox>
|
||||
}
|
||||
36
apparmor.d/groups/browsers/google-chrome-google-chrome
Normal file
36
apparmor.d/groups/browsers/google-chrome-google-chrome
Normal file
|
|
@ -0,0 +1,36 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{CHROME_INSTALLDIR} = /opt/google/chrome{,-beta,-unstable}
|
||||
@{CHROME_HOMEDIR} = @{HOME}/.config/google-chrome{,-beta,-unstable}
|
||||
@{CHROME_CACHEDIR} = @{HOME}/.cache/google-chrome{,-beta,-unstable}
|
||||
|
||||
@{exec_path} = @{CHROME_INSTALLDIR}/google-chrome{,-beta,-unstable}
|
||||
profile google-chrome-google-chrome @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
@{exec_path} r,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}bin/readlink rix,
|
||||
/{usr/,}bin/which rix,
|
||||
/{usr/,}bin/dirname rix,
|
||||
/{usr/,}bin/mkdir rix,
|
||||
/{usr/,}bin/cat rix,
|
||||
|
||||
@{CHROME_INSTALLDIR}/chrome rPx,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/* rw,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
include if exists <local/google-chrome-google-chrome>
|
||||
}
|
||||
202
apparmor.d/groups/browsers/opera
Normal file
202
apparmor.d/groups/browsers/opera
Normal file
|
|
@ -0,0 +1,202 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{OPERA_INSTALLDIR} = /{usr/,}lib/@{multiarch}/opera{,-beta,-developer}
|
||||
@{OPERA_HOMEDIR} = @{HOME}/.config/opera{,-beta,-developer}
|
||||
@{OPERA_CACHEDIR} = @{HOME}/.cache/opera{,-beta,-developer}
|
||||
|
||||
@{exec_path} = @{OPERA_INSTALLDIR}/opera{,-beta,-developer}
|
||||
profile opera @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/opencl-intel>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/mesa>
|
||||
include <abstractions/audio>
|
||||
include <abstractions/user-download-strict>
|
||||
include <abstractions/thumbnails-cache-read>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/openssl>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/deny-dconf>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
# The following rules are needed only when the kernel.unprivileged_userns_clone option is set
|
||||
# to "1".
|
||||
capability sys_admin,
|
||||
capability sys_chroot,
|
||||
owner @{PROC}/@{pid}/setgroups w,
|
||||
owner @{PROC}/@{pid}/gid_map w,
|
||||
owner @{PROC}/@{pid}/uid_map w,
|
||||
|
||||
ptrace (trace) peer=@{profile_name},
|
||||
|
||||
signal (send) set=(term, kill) peer=opera-sandbox,
|
||||
signal (send) set=(term, kill) peer=keepassxc-proxy,
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
/{usr/,}bin/which rix,
|
||||
|
||||
@{OPERA_INSTALLDIR}/opera_sandbox rPx,
|
||||
@{OPERA_INSTALLDIR}/opera_crashreporter rPx,
|
||||
@{OPERA_INSTALLDIR}/opera_autoupdate krix,
|
||||
|
||||
/{usr/,}bin/lsb_release rPx -> child-lsb_release,
|
||||
/{usr/,}bin/xdg-mime rPUx,
|
||||
/{usr/,}bin/xdg-open rCx -> open,
|
||||
/{usr/,}bin/xdg-settings rPUx,
|
||||
/{usr/,}bin/xdg-desktop-menu rPUx,
|
||||
/{usr/,}bin/xdg-icon-resource rPUx,
|
||||
|
||||
# To remove the following error:
|
||||
# Error initializing NSS with a persistent database
|
||||
owner @{HOME}/.pki/ rw,
|
||||
owner @{HOME}/.pki/nssdb/ rw,
|
||||
owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
|
||||
owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
|
||||
owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
|
||||
|
||||
# Opera home files
|
||||
owner @{HOME}/ r,
|
||||
owner @{OPERA_HOMEDIR}/ rw,
|
||||
owner @{OPERA_HOMEDIR}/** rwk,
|
||||
|
||||
owner @{HOME}/.local/share/.org.chromium.Chromium.* rw,
|
||||
|
||||
# Cache files
|
||||
owner @{HOME}/.cache/ rw,
|
||||
owner @{OPERA_CACHEDIR}/{,**/} rw,
|
||||
owner @{OPERA_CACHEDIR}/**/{*-,}index rw,
|
||||
owner @{OPERA_CACHEDIR}/**/[a-f0-9]*_? rw,
|
||||
owner @{OPERA_CACHEDIR}/**/todelete_* rw,
|
||||
|
||||
# For importing data (bookmarks, cookies, etc) from Firefox
|
||||
owner @{HOME}/.mozilla/firefox/profiles.ini r,
|
||||
owner @{HOME}/.mozilla/firefox/*/ r,
|
||||
owner @{HOME}/.mozilla/firefox/*/compatibility.ini r,
|
||||
owner @{HOME}/.mozilla/firefox/*/search{,-metadata}.json r,
|
||||
owner @{HOME}/.mozilla/firefox/*/.parentlock rwk,
|
||||
owner @{HOME}/.mozilla/firefox/*/{places,cookies,favicons,formhistory,}.sqlite{,-wal,-shm,-journal} rwk,
|
||||
owner @{HOME}/.mozilla/firefox/*/{cert9,key4}.db rwk,
|
||||
owner @{HOME}/.mozilla/firefox/*/logins.json r,
|
||||
# For importing data from Chromium
|
||||
owner "@{HOME}/.config/chromium/Local State" r,
|
||||
owner @{HOME}/.config/chromium/Singleton{Lock,Socket,Cookie} w,
|
||||
owner "@{HOME}/.config/chromium/*/Login Data{,-journal}" rwk,
|
||||
owner @{HOME}/.config/chromium/*/ r,
|
||||
owner @{HOME}/.config/chromium/*/{History,Cookies,Favicons,Bookmarks} rwk,
|
||||
|
||||
# Flashplayer
|
||||
owner @{HOME}/.config/google-chrome{,-beta,-unstable}/PepperFlash/**/manifest.json r,
|
||||
owner @{HOME}/.config/google-chrome{,-beta,-unstable}/PepperFlash/latest-component-updated-flash r,
|
||||
owner @{HOME}/.config/google-chrome{,-beta,-unstable}/PepperFlash/**/libpepflashplayer.so mr,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
|
||||
# Needed or opera crashes with the following error:
|
||||
# illegal hardware instruction
|
||||
@{PROC}/ r,
|
||||
#
|
||||
deny @{PROC}/vmstat r,
|
||||
@{PROC}/sys/kernel/yama/ptrace_scope r,
|
||||
@{PROC}/@{pid}/fd/ r,
|
||||
deny @{PROC}/@{pids}/stat r,
|
||||
deny @{PROC}/@{pids}/statm r,
|
||||
# To remove the following error:
|
||||
# Failed to adjust OOM score of renderer with pid : Permission denied
|
||||
deny owner @{PROC}/@{pid}/oom_{,score_}adj rw,
|
||||
#
|
||||
deny owner @{PROC}/@{pids}/cmdline r,
|
||||
deny owner @{PROC}/@{pids}/environ r,
|
||||
owner @{PROC}/@{pid}/task/ r,
|
||||
deny @{PROC}/@{pids}/task/@{tid}/stat r,
|
||||
deny @{PROC}/@{pids}/task/@{tid}/status r,
|
||||
deny owner @{PROC}/@{pid}/limits r,
|
||||
deny owner @{PROC}/@{pid}/mem r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
@{PROC}/sys/fs/inotify/max_user_watches r,
|
||||
|
||||
owner /dev/shm/.org.chromium.Chromium.* rw,
|
||||
|
||||
# To play DRM media (protected content)
|
||||
/opt/google/chrome{,-beta,-unstable}/libwidevinecdm.so mr,
|
||||
/opt/google/chrome{,-beta,-unstable}/libwidevinecdmadapter.so mr,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
# Udev enumeration
|
||||
@{sys}/bus/ r,
|
||||
@{sys}/bus/**/devices/ r,
|
||||
@{sys}/devices/**/uevent r,
|
||||
@{sys}/class/ r,
|
||||
@{sys}/class/**/ r,
|
||||
@{run}/udev/data/* r,
|
||||
@{sys}/devices/pci[0-9]*/**/usb[0-9]/{,**/}{descriptors,manufacturer,product,serial,bConfigurationValue} r,
|
||||
@{sys}/devices/pci[0-9]*/**/usb[0-9]/{,**/}{busnum,devnum} r,
|
||||
|
||||
deny @{sys}/devices/virtual/tty/tty[0-9]/active r,
|
||||
|
||||
# To remove the following error:
|
||||
# pcilib: Cannot open /sys/bus/pci/devices/0000:03:00.0/irq: Permission denied
|
||||
# The irq file is needed to render pages.
|
||||
@{sys}/devices/pci[0-9]*/**/irq r,
|
||||
|
||||
/var/tmp/ r,
|
||||
/tmp/ r,
|
||||
owner /tmp/.org.chromium.Chromium.* rw,
|
||||
owner /tmp/.org.chromium.Chromium.*/{,*} rw,
|
||||
|
||||
# For installing/updating extensions
|
||||
owner /tmp/scoped_dir*/{,**} rw,
|
||||
|
||||
# For crashreporter
|
||||
owner /tmp/opera-crashlog-[0-9]*-[0-9]*.txt rw,
|
||||
|
||||
/dev/ r,
|
||||
|
||||
# Silencer
|
||||
deny @{OPERA_INSTALLDIR}/** w,
|
||||
|
||||
|
||||
profile open {
|
||||
include <abstractions/base>
|
||||
include <abstractions/xdg-open>
|
||||
|
||||
/{usr/,}bin/xdg-open mr,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/gawk rix,
|
||||
/{usr/,}bin/readlink rix,
|
||||
/{usr/,}bin/basename rix,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
|
||||
owner @{run}/user/[0-9]*/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/opera>
|
||||
}
|
||||
39
apparmor.d/groups/browsers/opera-crashreporter
Normal file
39
apparmor.d/groups/browsers/opera-crashreporter
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{OPERA_INSTALLDIR} = /{usr/,}lib/@{multiarch}/opera{,-beta,-developer}
|
||||
@{OPERA_HOMEDIR} = @{HOME}/.config/opera{,-beta,-developer}
|
||||
@{OPERA_CACHEDIR} = @{HOME}/.cache/opera{,-beta,-developer}
|
||||
|
||||
@{exec_path} = @{OPERA_INSTALLDIR}/opera_crashreporter
|
||||
profile opera-crashreporter @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/openssl>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
ptrace (trace, read) peer=opera,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{OPERA_HOMEDIR}/crash_count.txt rwk,
|
||||
owner @{OPERA_HOMEDIR}/GPUCache/index r,
|
||||
owner @{OPERA_HOMEDIR}/GPUCache/data_* r,
|
||||
|
||||
deny owner @{PROC}/@{pids}/cmdline r,
|
||||
deny owner @{PROC}/@{pids}/environ r,
|
||||
owner @{PROC}/@{pids}/task/ r,
|
||||
|
||||
deny @{sys}/devices/system/cpu/cpufreq/policy[0-9]/cpuinfo_max_freq r,
|
||||
|
||||
include if exists <local/opera-crashreporter>
|
||||
}
|
||||
39
apparmor.d/groups/browsers/opera-sandbox
Normal file
39
apparmor.d/groups/browsers/opera-sandbox
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{OPERA_INSTALLDIR} = /{usr/,}lib/@{multiarch}/opera{,-beta,-developer}
|
||||
@{OPERA_HOMEDIR} = @{HOME}/.config/opera{,-beta,-developer}
|
||||
@{OPERA_CACHEDIR} = @{HOME}/.cache/opera{,-beta,-developer}
|
||||
|
||||
@{exec_path} = @{OPERA_INSTALLDIR}/opera_sandbox
|
||||
profile opera-sandbox @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
# For kernel unprivileged user namespaces
|
||||
capability sys_admin,
|
||||
capability sys_chroot,
|
||||
capability setuid,
|
||||
capability setgid,
|
||||
|
||||
# optional
|
||||
capability sys_resource,
|
||||
|
||||
signal (receive) set=(term, kill) peer=opera,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{OPERA_INSTALLDIR}/opera{,-beta,-developer} rPx,
|
||||
|
||||
@{PROC}/@{pids}/ r,
|
||||
deny owner @{PROC}/@{pid}/oom_{,score_}adj rw,
|
||||
|
||||
include if exists <local/opera-sandbox>
|
||||
}
|
||||
152
apparmor.d/groups/browsers/torbrowser.Browser.firefox
Normal file
152
apparmor.d/groups/browsers/torbrowser.Browser.firefox
Normal file
|
|
@ -0,0 +1,152 @@
|
|||
include <tunables/global>
|
||||
include <tunables/torbrowser>
|
||||
|
||||
@{torbrowser_firefox_executable} = /home/*/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/firefox.real
|
||||
|
||||
profile torbrowser_firefox @{torbrowser_firefox_executable} {
|
||||
include <abstractions/audio>
|
||||
include <abstractions/gnome>
|
||||
|
||||
# Uncomment the following lines if you want to give the Tor Browser read-write
|
||||
# access to most of your personal files.
|
||||
# include <abstractions/user-download>
|
||||
# @{HOME}/ r,
|
||||
|
||||
# Audio support
|
||||
/{,usr/}bin/pulseaudio Pixr,
|
||||
|
||||
#dbus,
|
||||
network netlink raw,
|
||||
network tcp,
|
||||
|
||||
ptrace (trace) peer=@{profile_name},
|
||||
signal (receive, send) set=("term") peer=@{profile_name},
|
||||
|
||||
deny /etc/host.conf r,
|
||||
deny /etc/hosts r,
|
||||
deny /etc/nsswitch.conf r,
|
||||
deny /etc/resolv.conf r,
|
||||
deny /etc/passwd r,
|
||||
deny /etc/group r,
|
||||
deny /etc/mailcap r,
|
||||
|
||||
/etc/machine-id r,
|
||||
/var/lib/dbus/machine-id r,
|
||||
|
||||
/dev/ r,
|
||||
/dev/shm/ r,
|
||||
|
||||
owner @{PROC}/@{pid}/environ r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/stat r,
|
||||
owner @{PROC}/@{pid}/status r,
|
||||
owner @{PROC}/@{pid}/task/*/stat r,
|
||||
@{PROC}/sys/kernel/random/uuid r,
|
||||
|
||||
owner @{torbrowser_installation_dir}/ r,
|
||||
owner @{torbrowser_installation_dir}/* r,
|
||||
owner @{torbrowser_installation_dir}/.** rwk,
|
||||
owner @{torbrowser_installation_dir}/update.test/ rwk,
|
||||
owner @{torbrowser_home_dir}/.** rwk,
|
||||
owner @{torbrowser_home_dir}/ rw,
|
||||
owner @{torbrowser_home_dir}/** rwk,
|
||||
owner @{torbrowser_home_dir}.bak/ rwk,
|
||||
owner @{torbrowser_home_dir}.bak/** rwk,
|
||||
owner @{torbrowser_home_dir}/*.so mr,
|
||||
owner @{torbrowser_home_dir}/.cache/fontconfig/ rwk,
|
||||
owner @{torbrowser_home_dir}/.cache/fontconfig/** rwkl,
|
||||
owner @{torbrowser_home_dir}/browser/** r,
|
||||
owner @{torbrowser_home_dir}/{,browser/}components/*.so mr,
|
||||
owner @{torbrowser_home_dir}/Downloads/ rwk,
|
||||
owner @{torbrowser_home_dir}/Downloads/** rwk,
|
||||
owner @{torbrowser_home_dir}/firefox rix,
|
||||
owner @{torbrowser_home_dir}/{,TorBrowser/UpdateInfo/}updates/[0-9]*/* rw,
|
||||
owner @{torbrowser_home_dir}/{,TorBrowser/UpdateInfo/}updates/[0-9]*/{,MozUpdater/bgupdate/}updater ix,
|
||||
owner @{torbrowser_home_dir}/updater ix,
|
||||
owner @{torbrowser_home_dir}/TorBrowser/Data/Browser/.parentwritetest rw,
|
||||
owner @{torbrowser_home_dir}/TorBrowser/Data/Browser/profiles.ini r,
|
||||
owner @{torbrowser_home_dir}/TorBrowser/Data/Browser/profile.default/{,**} rwk,
|
||||
owner @{torbrowser_home_dir}/TorBrowser/Data/fontconfig/fonts.conf r,
|
||||
owner @{torbrowser_home_dir}/fonts/* l,
|
||||
owner @{torbrowser_home_dir}/TorBrowser/Tor/tor px,
|
||||
owner @{torbrowser_home_dir}/TorBrowser/Tor/ r,
|
||||
owner @{torbrowser_home_dir}/TorBrowser/Tor/*.so mr,
|
||||
owner @{torbrowser_home_dir}/TorBrowser/Tor/*.so.* mr,
|
||||
owner @{torbrowser_home_dir}/TorBrowser/Tor/libstdc++/*.so mr,
|
||||
owner @{torbrowser_home_dir}/TorBrowser/Tor/libstdc++/*.so.* mr,
|
||||
|
||||
# parent Firefox process when restarting after upgrade, Web Content processes
|
||||
owner @{torbrowser_firefox_executable} pxmr -> torbrowser_firefox,
|
||||
|
||||
/etc/mailcap r,
|
||||
/etc/mime.types r,
|
||||
|
||||
/usr/share/ r,
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
/usr/share/mime/ r,
|
||||
/usr/share/themes/ r,
|
||||
/usr/share/applications/** rk,
|
||||
/usr/share/gnome/applications/ r,
|
||||
/usr/share/gnome/applications/kde4/ r,
|
||||
/usr/share/poppler/cMap/ r,
|
||||
|
||||
# Distribution homepage
|
||||
/usr/share/homepage/ r,
|
||||
/usr/share/homepage/** r,
|
||||
|
||||
/sys/devices/system/cpu/ r,
|
||||
/sys/devices/system/cpu/present r,
|
||||
/sys/devices/system/node/ r,
|
||||
/sys/devices/system/node/node[0-9]*/meminfo r,
|
||||
deny /sys/devices/virtual/block/*/uevent r,
|
||||
|
||||
# Should use abstractions/gstreamer instead once merged upstream
|
||||
/etc/udev/udev.conf r,
|
||||
/run/udev/data/+pci:* r,
|
||||
/sys/devices/pci[0-9]*/**/uevent r,
|
||||
owner /{dev,run}/shm/shmfd-* rw,
|
||||
|
||||
# Required for multiprocess Firefox (aka Electrolysis, i.e. e10s)
|
||||
owner /{dev,run}/shm/org.chromium.* rw,
|
||||
owner /dev/shm/org.mozilla.ipc.[0-9]*.[0-9]* rw, # for Chromium IPC
|
||||
|
||||
# Deny access to DRM nodes, that's granted by the X abstraction, which is
|
||||
# sourced by the gnome abstraction, that we include.
|
||||
deny /dev/dri/** rwklx,
|
||||
|
||||
# Silence denial logs about permissions we don't need
|
||||
deny /dev/dri/ rwklx,
|
||||
deny @{HOME}/.cache/fontconfig/ rw,
|
||||
deny @{HOME}/.cache/fontconfig/** rw,
|
||||
deny @{HOME}/.config/gtk-2.0/ rw,
|
||||
deny @{HOME}/.config/gtk-2.0/** rw,
|
||||
deny @{PROC}/@{pid}/net/route r,
|
||||
deny /sys/devices/system/cpu/cpufreq/policy[0-9]*/cpuinfo_max_freq r,
|
||||
deny /sys/devices/system/cpu/*/cache/index[0-9]*/size r,
|
||||
deny /run/user/[0-9]*/dconf/user rw,
|
||||
deny /usr/bin/lsb_release x,
|
||||
deny capability sys_admin,
|
||||
|
||||
# Silence denial logs about PulseAudio
|
||||
deny /etc/pulse/client.conf r,
|
||||
deny /usr/bin/pulseaudio x,
|
||||
|
||||
# KDE 4
|
||||
owner @{HOME}/.kde/share/config/* r,
|
||||
|
||||
# Xfce4
|
||||
/etc/xfce4/defaults.list r,
|
||||
/usr/share/xfce4/applications/ r,
|
||||
|
||||
# u2f (tested with Yubikey 4)
|
||||
/sys/class/ r,
|
||||
/sys/bus/ r,
|
||||
/sys/class/hidraw/ r,
|
||||
/run/udev/data/c24{7,9}:* r,
|
||||
/dev/hidraw* rw,
|
||||
# Yubikey NEO also needs this:
|
||||
/sys/devices/**/hidraw/hidraw*/uevent r,
|
||||
|
||||
include <local/torbrowser.Browser.firefox>
|
||||
}
|
||||
104
apparmor.d/groups/browsers/torbrowser.Browser.plugin-container
Normal file
104
apparmor.d/groups/browsers/torbrowser.Browser.plugin-container
Normal file
|
|
@ -0,0 +1,104 @@
|
|||
include <tunables/global>
|
||||
include <tunables/torbrowser>
|
||||
|
||||
@{torbrowser_firefox_executable} = /home/*/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/firefox.real
|
||||
|
||||
profile torbrowser_plugin_container {
|
||||
include <abstractions/gnome>
|
||||
|
||||
# Uncomment the following lines if you want Tor Browser
|
||||
# to have direct access to your sound hardware. You will also
|
||||
# need to remove, further bellow:
|
||||
# - the "deny" word in the machine-id lines
|
||||
# - the rules that deny reading /etc/pulse/client.conf
|
||||
# and executing /usr/bin/pulseaudio
|
||||
# include <abstractions/audio>
|
||||
# /etc/asound.conf r,
|
||||
# owner @{torbrowser_home_dir}/TorBrowser/Data/Browser/profile.default/tmp/mozilla-temp-* rw,
|
||||
|
||||
signal (receive) set=("term") peer=torbrowser_firefox,
|
||||
|
||||
deny /etc/host.conf r,
|
||||
deny /etc/hosts r,
|
||||
deny /etc/nsswitch.conf r,
|
||||
deny /etc/resolv.conf r,
|
||||
deny /etc/passwd r,
|
||||
deny /etc/group r,
|
||||
deny /etc/mailcap r,
|
||||
|
||||
deny /etc/machine-id r,
|
||||
deny /var/lib/dbus/machine-id r,
|
||||
|
||||
/etc/mime.types r,
|
||||
/usr/share/applications/gnome-mimeapps.list r,
|
||||
|
||||
/dev/shm/ r,
|
||||
|
||||
owner @{PROC}/@{pid}/environ r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/stat r,
|
||||
owner @{PROC}/@{pid}/status r,
|
||||
owner @{PROC}/@{pid}/task/*/stat r,
|
||||
@{PROC}/sys/kernel/random/uuid r,
|
||||
|
||||
owner @{torbrowser_home_dir}/*.dat r,
|
||||
owner @{torbrowser_home_dir}/*.manifest r,
|
||||
owner @{torbrowser_home_dir}/*.so mr,
|
||||
owner @{torbrowser_home_dir}/.cache/fontconfig/ rw,
|
||||
owner @{torbrowser_home_dir}/.cache/fontconfig/** rw,
|
||||
owner @{torbrowser_home_dir}/browser/** r,
|
||||
owner @{torbrowser_home_dir}/components/*.so mr,
|
||||
owner @{torbrowser_home_dir}/browser/components/*.so mr,
|
||||
owner @{torbrowser_home_dir}/defaults/pref/ r,
|
||||
owner @{torbrowser_home_dir}/defaults/pref/*.js r,
|
||||
owner @{torbrowser_home_dir}/dependentlibs.list r,
|
||||
owner @{torbrowser_home_dir}/fonts/ r,
|
||||
owner @{torbrowser_home_dir}/fonts/** r,
|
||||
owner @{torbrowser_home_dir}/omni.ja r,
|
||||
owner @{torbrowser_home_dir}/TorBrowser/Data/Browser/profile.default/extensions/*.xpi r,
|
||||
owner @{torbrowser_home_dir}/TorBrowser/Data/Browser/profiles.ini r,
|
||||
owner @{torbrowser_home_dir}/TorBrowser/UpdateInfo/updates/[0-9]*/update.{status,version} r,
|
||||
owner @{torbrowser_home_dir}/TorBrowser/UpdateInfo/updates/[0-9]/updater rw,
|
||||
owner @{torbrowser_home_dir}/TorBrowser/Data/Browser/profile.default/startupCache/* r,
|
||||
owner @{torbrowser_home_dir}/TorBrowser/Data/Browser/profile.default/tmp/* rw,
|
||||
owner @{torbrowser_home_dir}/TorBrowser/Data/fontconfig/fonts.conf r,
|
||||
owner @{torbrowser_home_dir}/TorBrowser/Tor/ r,
|
||||
owner @{torbrowser_home_dir}/TorBrowser/Tor/*.so mr,
|
||||
owner @{torbrowser_home_dir}/TorBrowser/Tor/*.so.* mr,
|
||||
owner @{torbrowser_home_dir}/Downloads/ rwk,
|
||||
owner @{torbrowser_home_dir}/Downloads/** rwk,
|
||||
|
||||
owner @{torbrowser_firefox_executable} ixmr -> torbrowser_plugin_container,
|
||||
|
||||
/sys/devices/system/cpu/ r,
|
||||
/sys/devices/system/cpu/present r,
|
||||
/sys/devices/system/node/ r,
|
||||
/sys/devices/system/node/node[0-9]*/meminfo r,
|
||||
deny /sys/devices/virtual/block/*/uevent r,
|
||||
|
||||
# Should use abstractions/gstreamer instead once merged upstream
|
||||
/etc/udev/udev.conf r,
|
||||
/run/udev/data/+pci:* r,
|
||||
/sys/devices/pci[0-9]*/**/uevent r,
|
||||
owner /{dev,run}/shm/shmfd-* rw,
|
||||
|
||||
# Required for multiprocess Firefox (aka Electrolysis, i.e. e10s)
|
||||
owner /{dev,run}/shm/org.chromium.* rw,
|
||||
|
||||
# Deny access to DRM nodes, that's granted by the X abstraction, which is
|
||||
# sourced by the gnome abstraction, that we include.
|
||||
deny /dev/dri/** rwklx,
|
||||
|
||||
# Silence denial logs about permissions we don't need
|
||||
deny /dev/dri/ rwklx,
|
||||
deny @{PROC}/@{pid}/net/route r,
|
||||
deny /sys/devices/system/cpu/cpufreq/policy[0-9]*/cpuinfo_max_freq r,
|
||||
deny /sys/devices/system/cpu/*/cache/index[0-9]*/size r,
|
||||
|
||||
# Silence denial logs about PulseAudio
|
||||
deny /etc/pulse/client.conf r,
|
||||
deny /usr/bin/pulseaudio x,
|
||||
|
||||
include <local/torbrowser.Browser.plugin-container>
|
||||
}
|
||||
46
apparmor.d/groups/browsers/torbrowser.Tor.tor
Normal file
46
apparmor.d/groups/browsers/torbrowser.Tor.tor
Normal file
|
|
@ -0,0 +1,46 @@
|
|||
include <tunables/global>
|
||||
include <tunables/torbrowser>
|
||||
|
||||
@{torbrowser_tor_executable} = /home/*/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/TorBrowser/Tor/tor
|
||||
|
||||
profile torbrowser_tor @{torbrowser_tor_executable} {
|
||||
include <abstractions/base>
|
||||
|
||||
network netlink raw,
|
||||
network tcp,
|
||||
network udp,
|
||||
|
||||
/etc/host.conf r,
|
||||
/etc/nsswitch.conf r,
|
||||
/etc/passwd r,
|
||||
/etc/resolv.conf r,
|
||||
owner @{torbrowser_home_dir}/TorBrowser/Tor/tor mr,
|
||||
owner @{torbrowser_home_dir}/TorBrowser/Data/Tor/ rw,
|
||||
owner @{torbrowser_home_dir}/TorBrowser/Data/Tor/** rw,
|
||||
owner @{torbrowser_home_dir}/TorBrowser/Data/Tor/lock rwk,
|
||||
owner @{torbrowser_home_dir}/TorBrowser/Tor/*.so mr,
|
||||
owner @{torbrowser_home_dir}/TorBrowser/Tor/*.so.* mr,
|
||||
|
||||
# Support some of the included pluggable transports
|
||||
owner @{torbrowser_home_dir}/TorBrowser/Tor/PluggableTransports/** rix,
|
||||
@{PROC}/sys/net/core/somaxconn r,
|
||||
include <abstractions/ssl_certs>
|
||||
|
||||
# Silence file_inherit logs
|
||||
deny @{torbrowser_home_dir}/{browser/,}omni.ja r,
|
||||
deny @{torbrowser_home_dir}/{browser/,}features/*.xpi r,
|
||||
deny @{torbrowser_home_dir}/TorBrowser/Data/Browser/profile.default/.parentlock rw,
|
||||
deny @{torbrowser_home_dir}/TorBrowser/Data/Browser/profile.default/extensions/*.xpi r,
|
||||
deny @{torbrowser_home_dir}/TorBrowser/Data/Browser/profile.default/startupCache/* r,
|
||||
# Silence logs from included pluggable transports
|
||||
deny /etc/hosts r,
|
||||
deny /etc/services r,
|
||||
|
||||
@{PROC}/sys/kernel/random/uuid r,
|
||||
/sys/devices/system/cpu/ r,
|
||||
|
||||
# OnionShare compatibility
|
||||
/tmp/onionshare/** rw,
|
||||
|
||||
include <local/torbrowser.Tor.tor>
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue