X-Git-Url: https://git.lizzy.rs/?a=blobdiff_plain;f=apparmor%2Ftorbrowser.Browser.firefox;h=6882f9d9ae186c129e4faa55529953c5ba81137b;hb=499c971308c687c55cd0b203c6439b34510f77c8;hp=686712e0b2309b5d89b09b1eb6629f40ca1088c2;hpb=33f1d89270c17caf6934f49bf890b900d3b1a3c0;p=torbrowser-launcher.git diff --git a/apparmor/torbrowser.Browser.firefox b/apparmor/torbrowser.Browser.firefox index 686712e..6882f9d 100644 --- a/apparmor/torbrowser.Browser.firefox +++ b/apparmor/torbrowser.Browser.firefox @@ -1,22 +1,29 @@ -# Last modified #include +#include -/home/*/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/firefox { - #include +@{torbrowser_firefox_executable} = /home/*/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/firefox.real - # Uncomment the following line if you don't want the Tor Browser - # to have direct access to your sound hardware. Note that this is not - # enough to have working sound support in Tor Browser. - # #include +profile torbrowser_firefox @{torbrowser_firefox_executable} { + #include + #include + #include + #include if exists # Uncomment the following lines if you want to give the Tor Browser read-write # access to most of your personal files. # #include # @{HOME}/ r, + # Audio support + /{,usr/}bin/pulseaudio Pixr, + #dbus, + network netlink raw, network tcp, + ptrace (trace) peer=@{profile_name}, + signal (receive, send) set=("term") peer=@{profile_name}, + deny /etc/host.conf r, deny /etc/hosts r, deny /etc/nsswitch.conf r, @@ -25,43 +32,61 @@ deny /etc/group r, deny /etc/mailcap r, - deny /etc/machine-id r, - deny /var/lib/dbus/machine-id r, + /etc/machine-id r, + /var/lib/dbus/machine-id r, - @{PROC}/[0-9]*/mountinfo r, - @{PROC}/[0-9]*/stat r, - @{PROC}/[0-9]*/task/*/stat r, + /dev/ r, + /dev/shm/ r, + + owner @{PROC}/@{pid}/cgroup r, + owner @{PROC}/@{pid}/environ r, + owner @{PROC}/@{pid}/fd/ r, + owner @{PROC}/@{pid}/mountinfo r, + owner @{PROC}/@{pid}/stat r, + owner @{PROC}/@{pid}/status r, + owner @{PROC}/@{pid}/task/*/stat r, @{PROC}/sys/kernel/random/uuid r, - owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/ r, - owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/* r, - owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/.** rwk, - owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/update.test/ rwk, - owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/.** rwk, - owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/ rw, - owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/** rw, - owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser.bak/ rwk, - owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser.bak/updated/ rwk, - owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/*.so mr, - owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/components/*.so mr, - owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/browser/components/*.so mr, - owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/firefox rix, - owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/updates/[0-9]*/updater ix, - owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/updates/0/MozUpdater/bgupdate/updater ix, - owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/TorBrowser/Data/Browser/profiles.ini r, - owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/TorBrowser/Data/Browser/profile.default/ r, - owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/TorBrowser/Data/Browser/profile.default/** rwk, - owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/TorBrowser/Tor/tor px, - owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/TorBrowser/Tor/libstdc++.so.6 m, - owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/Desktop/ rw, - owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/Desktop/** rwk, - owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/Downloads/ rw, - owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/Downloads/** rwk, + owner @{torbrowser_installation_dir}/ r, + owner @{torbrowser_installation_dir}/* r, + owner @{torbrowser_installation_dir}/.** rwk, + owner @{torbrowser_installation_dir}/update.test/ rwk, + owner @{torbrowser_home_dir}/.** rwk, + owner @{torbrowser_home_dir}/ rw, + owner @{torbrowser_home_dir}/** rwk, + owner @{torbrowser_home_dir}.bak/ rwk, + owner @{torbrowser_home_dir}.bak/** rwk, + owner @{torbrowser_home_dir}/*.so mr, + owner @{torbrowser_home_dir}/.cache/fontconfig/ rwk, + owner @{torbrowser_home_dir}/.cache/fontconfig/** rwkl, + owner @{torbrowser_home_dir}/browser/** r, + owner @{torbrowser_home_dir}/{,browser/}components/*.so mr, + owner @{torbrowser_home_dir}/Downloads/ rwk, + owner @{torbrowser_home_dir}/Downloads/** rwk, + owner @{torbrowser_home_dir}/firefox rix, + owner @{torbrowser_home_dir}/{,TorBrowser/UpdateInfo/}updates/[0-9]*/* rw, + owner @{torbrowser_home_dir}/{,TorBrowser/UpdateInfo/}updates/[0-9]*/{,MozUpdater/bgupdate/}updater ix, + owner @{torbrowser_home_dir}/updater ix, + owner @{torbrowser_home_dir}/TorBrowser/Data/Browser/.parentwritetest rw, + owner @{torbrowser_home_dir}/TorBrowser/Data/Browser/profiles.ini r, + owner @{torbrowser_home_dir}/TorBrowser/Data/Browser/profile.default/{,**} rwk, + owner @{torbrowser_home_dir}/TorBrowser/Data/fontconfig/fonts.conf r, + owner @{torbrowser_home_dir}/fonts/* l, + owner @{torbrowser_home_dir}/TorBrowser/Tor/tor px, + owner @{torbrowser_home_dir}/TorBrowser/Tor/ r, + owner @{torbrowser_home_dir}/TorBrowser/Tor/*.so mr, + owner @{torbrowser_home_dir}/TorBrowser/Tor/*.so.* mr, + owner @{torbrowser_home_dir}/TorBrowser/Tor/libstdc++/*.so mr, + owner @{torbrowser_home_dir}/TorBrowser/Tor/libstdc++/*.so.* mr, + + # parent Firefox process when restarting after upgrade, Web Content processes + owner @{torbrowser_firefox_executable} pxmr -> torbrowser_firefox, /etc/mailcap r, /etc/mime.types r, /usr/share/ r, + /usr/share/glib-2.0/schemas/gschemas.compiled r, /usr/share/mime/ r, /usr/share/themes/ r, /usr/share/applications/** rk, @@ -75,6 +100,9 @@ /sys/devices/system/cpu/ r, /sys/devices/system/cpu/present r, + /sys/devices/system/node/ r, + /sys/devices/system/node/node[0-9]*/meminfo r, + /sys/fs/cgroup/cpu,cpuacct/{,user.slice/}cpu.cfs_quota_us r, deny /sys/devices/virtual/block/*/uevent r, # Should use abstractions/gstreamer instead once merged upstream @@ -83,6 +111,30 @@ /sys/devices/pci[0-9]*/**/uevent r, owner /{dev,run}/shm/shmfd-* rw, + # Required for multiprocess Firefox (aka Electrolysis, i.e. e10s) + owner /{dev,run}/shm/org.chromium.* rw, + owner /dev/shm/org.mozilla.ipc.[0-9]*.[0-9]* rw, # for Chromium IPC + + # Deny access to DRM nodes, that's granted by the X abstraction, which is + # sourced by the gnome abstraction, that we include. + deny /dev/dri/** rwklx, + + # Silence denial logs about permissions we don't need + deny /dev/dri/ rwklx, + deny @{HOME}/.cache/fontconfig/ rw, + deny @{HOME}/.cache/fontconfig/** rw, + deny @{HOME}/.config/gtk-2.0/ rw, + deny @{HOME}/.config/gtk-2.0/** rw, + deny @{PROC}/@{pid}/net/route r, + deny /sys/devices/system/cpu/cpufreq/policy[0-9]*/cpuinfo_max_freq r, + deny /sys/devices/system/cpu/*/cache/index[0-9]*/size r, + deny /run/user/[0-9]*/dconf/user rw, + deny /usr/bin/lsb_release x, + + # Silence denial logs about PulseAudio + deny /etc/pulse/client.conf r, + deny /usr/bin/pulseaudio x, + # KDE 4 owner @{HOME}/.kde/share/config/* r, @@ -90,5 +142,20 @@ /etc/xfce4/defaults.list r, /usr/share/xfce4/applications/ r, + # u2f (tested with Yubikey 4) + /sys/class/ r, + /sys/bus/ r, + /sys/class/hidraw/ r, + /run/udev/data/c24{7,9}:* r, + /dev/hidraw* rw, + # Yubikey NEO also needs this: + /sys/devices/**/hidraw/hidraw*/uevent r, + + # Needed for Firefox sandboxing via unprivileged user namespaces + capability sys_admin, + capability sys_chroot, + owner @{PROC}/@{pid}/{gid,uid}_map w, + owner @{PROC}/@{pid}/setgroups w, + #include }