update apparmor profiles

apparmor.d/groups/browsers/brave-browser

@@ -21,7 +21,7 @@ profile brave-browser @{exec_path} {
 
   /{usr/,}bin/readlink      rix,
   /{usr/,}bin/dirname       rix,
-  /{usr/,}bin/which         rix,
+  /{usr/,}bin/which{,.debianutils}         rix,
   /{usr/,}bin/mkdir         rix,
   /{usr/,}bin/cat           rix,
 

apparmor.d/groups/browsers/google-chrome-google-chrome

@@ -20,7 +20,7 @@ profile google-chrome-google-chrome @{exec_path} {
   /{usr/,}bin/{,ba,da}sh rix,
 
   /{usr/,}bin/readlink   rix,
-  /{usr/,}bin/which      rix,
+  /{usr/,}bin/which{,.debianutils}      rix,
   /{usr/,}bin/dirname    rix,
   /{usr/,}bin/mkdir      rix,
   /{usr/,}bin/cat        rix,

apparmor.d/groups/browsers/opera

@@ -49,7 +49,7 @@ profile opera @{exec_path} {
 
   @{exec_path} mrix,
 
-  /{usr/,}bin/which                        rix,
+  /{usr/,}bin/which{,.debianutils}                        rix,
 
   @{OPERA_INSTALLDIR}/opera_sandbox        rPx,
   @{OPERA_INSTALLDIR}/opera_crashreporter  rPx,

apparmor.d/groups/browsers/torbrowser.Browser.firefox

@@ -1,15 +1,17 @@
-include <tunables/global>
-include <tunables/torbrowser>
+#include <tunables/global>
+#include <tunables/torbrowser>
 
 @{torbrowser_firefox_executable} = /home/*/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/firefox.real
 
 profile torbrowser_firefox @{torbrowser_firefox_executable} {
-  include <abstractions/audio>
-  include <abstractions/gnome>
+  #include <abstractions/audio>
+  #include <abstractions/gnome>
+  #include <abstractions/ibus>
+  #include if exists <abstractions/vulkan>
 
   # Uncomment the following lines if you want to give the Tor Browser read-write
   # access to most of your personal files.
-  # include <abstractions/user-download>
+  # #include <abstractions/user-download>
   # @{HOME}/ r,
 
   # Audio support
@@ -36,6 +38,7 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} {
   /dev/ r,
   /dev/shm/ r,
 
+  owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/environ r,
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/mountinfo r,
@@ -90,6 +93,7 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} {
   /usr/share/gnome/applications/ r,
   /usr/share/gnome/applications/kde4/ r,
   /usr/share/poppler/cMap/ r,
+  /etc/xdg/mimeapps.list r,
 
   # Distribution homepage
   /usr/share/homepage/ r,
@@ -99,6 +103,7 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} {
   /sys/devices/system/cpu/present r,
   /sys/devices/system/node/ r,
   /sys/devices/system/node/node[0-9]*/meminfo r,
+  /sys/fs/cgroup/cpu,cpuacct/{,user.slice/}cpu.cfs_quota_us r,
   deny /sys/devices/virtual/block/*/uevent r,
 
   # Should use abstractions/gstreamer instead once merged upstream
@@ -111,6 +116,9 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} {
   owner /{dev,run}/shm/org.chromium.* rw,
   owner /dev/shm/org.mozilla.ipc.[0-9]*.[0-9]* rw, # for Chromium IPC
 
+  # Required for Wayland display protocol support
+  owner /dev/shm/wayland.mozilla.ipc.[0-9]* rw,
+
   # Deny access to DRM nodes, that's granted by the X abstraction, which is
   # sourced by the gnome abstraction, that we include.
   deny /dev/dri/** rwklx,
@@ -126,7 +134,6 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} {
   deny /sys/devices/system/cpu/*/cache/index[0-9]*/size r,
   deny /run/user/[0-9]*/dconf/user rw,
   deny /usr/bin/lsb_release x,
-  deny capability sys_admin,
 
   # Silence denial logs about PulseAudio
   deny /etc/pulse/client.conf r,
@@ -143,10 +150,16 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} {
   /sys/class/ r,
   /sys/bus/ r,
   /sys/class/hidraw/ r,
-  /run/udev/data/c24{7,9}:* r,
+  /run/udev/data/c24{5,7,9}:* r,
   /dev/hidraw* rw,
   # Yubikey NEO also needs this:
   /sys/devices/**/hidraw/hidraw*/uevent r,
 
-  include if exists <local/torbrowser.Browser.firefox>
+  # Needed for Firefox sandboxing via unprivileged user namespaces
+  capability sys_admin,
+  capability sys_chroot,
+  owner @{PROC}/@{pid}/{gid,uid}_map w,
+  owner @{PROC}/@{pid}/setgroups w,
+
+  #include if exists <local/torbrowser.Browser.firefox>
 }