AppArmor: confine Firefox 60 "Web Content" processes under the torbrowser_plugin_cont...

diff --git a/apparmor/torbrowser.Browser.firefox b/apparmor/torbrowser.Browser.firefox
index 69354d1b87302f57d84694c9a4f5a0ed4094ca37..9f269e1702416ae99ab61c7efb46e025af522922 100644 (file)
--- a/apparmor/torbrowser.Browser.firefox
+++ b/apparmor/torbrowser.Browser.firefox
@@ -54,7 +54,6 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} {
   owner @{torbrowser_home_dir}/components/*.so mr,
   owner @{torbrowser_home_dir}/browser/components/*.so mr,
   owner @{torbrowser_home_dir}/firefox rix,
-  owner @{torbrowser_home_dir}/plugin-container px -> torbrowser_plugin_container,
   owner @{torbrowser_home_dir}/{,TorBrowser/UpdateInfo/}updates/[0-9]*/updater ix,
   owner @{torbrowser_home_dir}/{,TorBrowser/UpdateInfo/}updates/0/MozUpdater/bgupdate/updater ix,
   owner @{torbrowser_home_dir}/TorBrowser/Data/Browser/profiles.ini r,
@@ -64,6 +63,9 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} {
   owner @{torbrowser_home_dir}/TorBrowser/Tor/*.so mr,
   owner @{torbrowser_home_dir}/TorBrowser/Tor/*.so.* mr,
 
+  # Web Content processes
+  owner @{torbrowser_firefox_executable} px -> torbrowser_plugin_container,
+
   /etc/mailcap r,
   /etc/mime.types r,
 

diff --git a/apparmor/torbrowser.Browser.plugin-container b/apparmor/torbrowser.Browser.plugin-container
index fe95fdb216c5f6607da91407d773c550e50c48ad..c1c4ccb480b13a7891e7ef32ce5a87fca02ab7ac 100644 (file)
--- a/apparmor/torbrowser.Browser.plugin-container
+++ b/apparmor/torbrowser.Browser.plugin-container
@@ -1,6 +1,8 @@
 #include <tunables/global>
 #include <tunables/torbrowser>
 
+@{torbrowser_firefox_executable} = /home/*/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/firefox.real
+
 profile torbrowser_plugin_container {
   #include <abstractions/gnome>
 
@@ -52,7 +54,6 @@ profile torbrowser_plugin_container {
   owner @{torbrowser_home_dir}/fonts/   r,
   owner @{torbrowser_home_dir}/fonts/** r,
   owner @{torbrowser_home_dir}/omni.ja r,
-  owner @{torbrowser_home_dir}/plugin-container ixmr,
   owner @{torbrowser_home_dir}/TorBrowser/Data/Browser/profile.default/extensions/*.xpi r,
   owner @{torbrowser_home_dir}/TorBrowser/Data/Browser/profile.default/tmp/* rw,
   owner @{torbrowser_home_dir}/TorBrowser/Data/fontconfig/fonts.conf r,
@@ -62,6 +63,8 @@ profile torbrowser_plugin_container {
   owner @{torbrowser_home_dir}/Downloads/ rwk,
   owner @{torbrowser_home_dir}/Downloads/** rwk,
 
+  owner @{torbrowser_firefox_executable} ixmr -> torbrowser_plugin_container,
+
   /sys/devices/system/cpu/ r,
   /sys/devices/system/cpu/present r,
   /sys/devices/system/node/ r,