apparmor/torbrowser.Browser.firefox

   1 # Last modified
   2 #include <tunables/global>
   3
   4 /home/*/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/firefox {
   5   #include <abstractions/gnome>
   6   #include <abstractions/audio>
   7   #include <abstractions/user-download>
   8
   9   deny /etc/host.conf r,
  10   deny /etc/hosts r,
  11   deny /etc/nsswitch.conf r,
  12   deny /etc/resolv.conf r,
  13   deny /etc/passwd r,
  14   deny /etc/group r,
  15   deny /etc/udev/udev.conf r,
  16   deny /etc/mailcap r,
  17
  18   deny @{PROC}/[0-9]*/stat r,
  19   deny @{PROC}/[0-9]*/mountinfo r,
  20   deny @{PROC}/[0-9]*/task/** r,
  21   deny @{PROC}/sys/kernel/random/uuid r,
  22   deny @{PROC}/[0-9]*/fd/ r,
  23   deny @{PROC}/[0-9]*/stat r,
  24   deny @{PROC}/[0-9]*/task/*/stat r,
  25
  26   deny /run/udev/** r,
  27   deny /sys/devices/** r,
  28   deny /var/lib/dbus/machine-id r,
  29
  30   ## Missing in <abstractions/user-download> #######
  31   # Without this line, access is denied to @{HOME},
  32   # [dD]ownload{,s}, Desktop... for downloads.
  33   @{HOME}/ r,
  34   ##################################################
  35
  36   @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/ r,
  37   @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/* r,
  38   @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_en-US/.** rwk,
  39   @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/** r,
  40   @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/*.so mr,
  41   @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/components/*.so mr,
  42   @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/browser/components/*.so mr,
  43   @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/firefox rix,
  44   @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Data/Browser/profiles.ini r,
  45   @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Data/Browser/profile.default/** rwk,
  46   @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Data/Tor/* rwk,
  47   @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Tor/* mr,
  48   @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Tor/tor rix,
  49
  50   /etc/mime.types r,
  51
  52   /usr/share/ r,
  53   /usr/share/mime/ r,
  54   /usr/share/mime/** r,
  55   /usr/share/themes/ r,
  56   /usr/share/themes/** r,
  57   /usr/share/applications/** rk,
  58   /usr/share/poppler/cMap/ r,
  59   /usr/share/poppler/cMap/** r,
  60
  61   ## Might flash a message when some packages are installed
  62   #/usr/share/fontconfig/conf.avail/* r,
  63   #/var/cache/fontconfig/ rk,
  64
  65   ## KDE 4 ##
  66   @{HOME}/.kde/share/config/* r,
  67
  68   ## Xfce4 ##
  69   /etc/xfce4/defaults.list r,
  70   /usr/share/xfce4/applications/ r,
  71 }