felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

update apparmor profiles

Browse source
This commit is contained in:
Mikhail Morfikov 2021-05-26 10:49:17 +02:00 • committed by Alexandre Pujol
parent 1ab54c1ed1
commit e085014238
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
37 changed files with 447 additions and 56 deletions
Download patch file Download diff file Expand all files Collapse all files

9
apparmor.d/groups/browsers/firefox
View file

@ -1,5 +1,5 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2015-2020 Mikhail Morfikov
# Copyright (C) 2015-2021 Mikhail Morfikov
# 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
@ -100,6 +100,12 @@ profile firefox @{exec_path} {
deny @{sys}/devices/system/cpu/cpufreq/policy[0-9]/cpuinfo_max_freq r,
deny @{sys}/devices/system/cpu/cpu[0-9]/cache/index[0-9]/size r,
# For Cryptographic Attestation of Personhood
#@{sys}/bus/ r,
#@{sys}/class/ r,
#@{sys}/class/hidraw/ r,
#@{run}/udev/data/c241:[0-9]* r, # dynamic
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/cgroup r,
deny owner @{PROC}/@{pid}/stat r,
@ -126,6 +132,7 @@ profile firefox @{exec_path} {
# Set default browser
/{usr/,}bin/update-mime-database rPx,
owner @{user_config_dirs}/ r,
owner @{user_config_dirs}/mimeapps.list{,.*} rw,
owner @{user_share_dirs}/mime/packages/user-extension-{htm,html,xht,xhtml,shtml}.xml rw,
owner @{user_share_dirs}/mime/packages/user-extension-{htm,html,xht,xhtml,shtml}.xml.* rw,

9
apparmor.d/groups/browsers/torbrowser.Tor.tor
View file

@ -1,10 +1,10 @@
include <tunables/global>
include <tunables/torbrowser>
#include <tunables/global>
#include <tunables/torbrowser>
@{torbrowser_tor_executable} = /home/*/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/TorBrowser/Tor/tor
profile torbrowser_tor @{torbrowser_tor_executable} {
include <abstractions/base>
#include <abstractions/base>
network netlink raw,
network tcp,
@ -24,7 +24,7 @@ profile torbrowser_tor @{torbrowser_tor_executable} {
# Support some of the included pluggable transports
owner @{torbrowser_home_dir}/TorBrowser/Tor/PluggableTransports/** rix,
@{PROC}/sys/net/core/somaxconn r,
include <abstractions/ssl_certs>
#include <abstractions/ssl_certs>
# Silence file_inherit logs
deny @{torbrowser_home_dir}/{browser/,}omni.ja r,
@ -38,6 +38,7 @@ profile torbrowser_tor @{torbrowser_tor_executable} {
@{PROC}/sys/kernel/random/uuid r,
/sys/devices/system/cpu/ r,
/sys/kernel/mm/transparent_hugepage/hpage_pmd_size r,
# OnionShare compatibility
/tmp/onionshare/** rw,