AppArmor: Allow reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us

Roger Shimizu told us it's needed on Debian Buster.
I suppose the "user.slice" path component is not used there.

diff --git a/apparmor/torbrowser.Browser.firefox b/apparmor/torbrowser.Browser.firefox
index b086cb79739d95ffcd8b64abd8ad7e4dd4a763cc..6882f9d9ae186c129e4faa55529953c5ba81137b 100644 (file)
--- a/apparmor/torbrowser.Browser.firefox
+++ b/apparmor/torbrowser.Browser.firefox
@@ -102,7 +102,7 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} {
   /sys/devices/system/cpu/present r,
   /sys/devices/system/node/ r,
   /sys/devices/system/node/node[0-9]*/meminfo r,
-  /sys/fs/cgroup/cpu,cpuacct/user.slice/cpu.cfs_quota_us r,
+  /sys/fs/cgroup/cpu,cpuacct/{,user.slice/}cpu.cfs_quota_us r,
   deny /sys/devices/virtual/block/*/uevent r,
 
   # Should use abstractions/gstreamer instead once merged upstream