68d1222029
Add vim modeline instructing the editor to use syntax plugin provided by apparmor. Continuation of #395 to keep the diff list relatively short.
73 lines
2.2 KiB
Text
73 lines
2.2 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{name} = torbrowser "tor browser"
|
|
@{lib_dirs} = @{HOME}/.tb/tor-browser/Browser/
|
|
@{data_dirs} = @{lib_dirs}/TorBrowser/Data/
|
|
@{config_dirs} = @{data_dirs}/Browser/*.default/
|
|
@{cache_dirs} = @{data_dirs}/Browser/Caches
|
|
|
|
@{exec_path} = @{lib_dirs}/firefox{,.real}
|
|
profile torbrowser @{exec_path} flags=(attach_disconnected) {
|
|
include <abstractions/base>
|
|
include <abstractions/app/firefox>
|
|
|
|
@{exec_path} mrix,
|
|
|
|
@{lib_dirs}/abicheck rix,
|
|
@{lib_dirs}/updater rPx,
|
|
|
|
/usr/share/homepage/{,**} r,
|
|
|
|
owner @{lib_dirs}/.cache/{,**} rw,
|
|
owner @{lib_dirs}/.local/{,**} rw,
|
|
owner @{lib_dirs}/Downloads/{,**} rw,
|
|
owner @{lib_dirs}/fonts/** r,
|
|
owner @{lib_dirs}/TorBrowser/UpdateInfo/{,**} rw,
|
|
|
|
owner "@{tmp}/Tor Project*" rwk,
|
|
owner "@{tmp}/Tor Project*/" rw,
|
|
owner "@{tmp}/Tor Project*/**" rwk,
|
|
|
|
# Due to the nature of the browser, we silence much more than for Firefox.
|
|
deny network inet dgram, # TOR does not work over UDP
|
|
deny network inet6 dgram,
|
|
deny dbus (send receive) bus=session path=/ca/desrt/dconf/Writer/user,
|
|
deny @{bin}/lsb_release x,
|
|
deny @{lib_dirs}/crashreporter x,
|
|
deny @{lib_dirs}/glxtest x,
|
|
deny @{lib_dirs}/minidump-analyzer x,
|
|
deny @{lib_dirs}/pingsender x,
|
|
deny /usr/share/dconf/** r,
|
|
deny /etc/dconf/** r,
|
|
deny /etc/fstab r,
|
|
deny /etc/group r,
|
|
deny /etc/host.conf r,
|
|
deny /etc/hosts r,
|
|
deny /etc/machine-id r,
|
|
deny /etc/mailcap r,
|
|
deny /etc/nsswitch.conf r,
|
|
deny /etc/os-release r,
|
|
deny /etc/passwd r,
|
|
deny /etc/resolv.conf r,
|
|
deny /var/lib/dbus/machine-id r,
|
|
deny owner @{user_config_dirs}/dconf/user r,
|
|
deny owner @{user_config_dirs}/gtk-*/{,**} rw,
|
|
deny owner @{run}/user/@{uid}/dconf/ rw,
|
|
deny owner @{run}/user/@{uid}/dconf/user rw,
|
|
deny @{sys}/class/input/ r,
|
|
deny @{sys}/devices/system/cpu/*/cache/index@{int}/size r,
|
|
deny @{sys}/devices/system/cpu/cpufreq/policy@{int}/cpuinfo_max_freq r,
|
|
deny @{sys}/devices/virtual/block/*/uevent r,
|
|
deny @{PROC}/@{pid}/net/if_inet6 r,
|
|
deny @{PROC}/@{pid}/net/route r,
|
|
|
|
include if exists <local/torbrowser>
|
|
}
|
|
|
|
# vim:syntax=apparmor
|