apparmor/torbrowser.Browser.firefox

   1 # Last modified
   2 #include <tunables/global>
   3
   4 /home/*/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/firefox {
   5   #include <abstractions/gnome>
   6
   7   # Uncomment the following line if you don't want the Tor Browser
   8   # to have direct access to your sound hardware. Note that this is not
   9   # enough to have working sound support in Tor Browser.
  10   # #include <abstractions/audio>
  11
  12   # Uncomment the following lines if you want to give the Tor Browser read-write
  13   # access to most of your personal files.
  14   # #include <abstractions/user-download>
  15   # @{HOME}/ r,
  16
  17   #dbus,
  18   network tcp,
  19
  20   deny /etc/host.conf r,
  21   deny /etc/hosts r,
  22   deny /etc/nsswitch.conf r,
  23   deny /etc/resolv.conf r,
  24   deny /etc/passwd r,
  25   deny /etc/group r,
  26   deny /etc/mailcap r,
  27
  28   deny /etc/machine-id r,
  29   deny /var/lib/dbus/machine-id r,
  30
  31   @{PROC}/[0-9]*/mountinfo r,
  32   @{PROC}/[0-9]*/stat r,
  33   @{PROC}/[0-9]*/task/*/stat r,
  34   @{PROC}/sys/kernel/random/uuid r,
  35
  36   owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/ r,
  37   owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/* r,
  38   owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/.** rwk,
  39   owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/update.test/ rwk,
  40   owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/.** rwk,
  41   owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/ rw,
  42   owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/** rw,
  43   owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser.bak/updated/ rwk,
  44   owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/*.so mr,
  45   owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/components/*.so mr,
  46   owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/browser/components/*.so mr,
  47   owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/firefox rix,
  48   owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/updates/[0-9]*/updater ix,
  49   owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/updates/0/MozUpdater/bgupdate/updater ix,
  50   owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/TorBrowser/Data/Browser/profiles.ini r,
  51   owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/TorBrowser/Data/Browser/profile.default/ r,
  52   owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/TorBrowser/Data/Browser/profile.default/** rwk,
  53   owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/TorBrowser/Tor/tor Px,
  54   owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/TorBrowser/Tor/libstdc++.so.6 m,
  55   owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/Desktop/ rw,
  56   owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/Desktop/** rwk,
  57   owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/Downloads/ rw,
  58   owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/Downloads/** rwk,
  59
  60   /etc/mailcap r,
  61   /etc/mime.types r,
  62
  63   /usr/share/ r,
  64   /usr/share/mime/ r,
  65   /usr/share/themes/ r,
  66   /usr/share/applications/** rk,
  67   /usr/share/gnome/applications/ r,
  68   /usr/share/gnome/applications/kde4/ r,
  69   /usr/share/poppler/cMap/ r,
  70
  71   # Distribution homepage
  72   /usr/share/homepage/ r,
  73   /usr/share/homepage/** r,
  74
  75   /sys/devices/system/cpu/ r,
  76   /sys/devices/system/cpu/present r,
  77   deny /sys/devices/virtual/block/*/uevent r,
  78
  79   # Should use abstractions/gstreamer instead once merged upstream
  80   /etc/udev/udev.conf r,
  81   /run/udev/data/+pci:* r,
  82   /sys/devices/pci[0-9]*/**/uevent r,
  83   owner /{dev,run}/shm/shmfd-* rw,
  84
  85   # KDE 4
  86   owner @{HOME}/.kde/share/config/* r,
  87
  88   # Xfce4
  89   /etc/xfce4/defaults.list r,
  90   /usr/share/xfce4/applications/ r,
  91
  92   #include <local/torbrowser.Browser.firefox>
  93 }