firefox apparmor profile for opensuse 13.1

#include <tunables/global>

/usr/lib{,64}/firefox/firefox{,*[^s][^h]} {
  #include <abstractions/base>
  #include <abstractions/X>
  #include <abstractions/audio>
  #include <abstractions/cups-client>
  #include <abstractions/dbus>
  #include <abstractions/dbus-session>
  #include <abstractions/gnome>
  #include <abstractions/ibus>
  #include <abstractions/nameservice>
  #include <abstractions/p11-kit>

  # base requirments
  network inet stream,
  network inet6 stream,

  # proc entries
  @{PROC}/ r,
  @{PROC}/filesystems r,

  owner @{PROC}/[0-9]*/net/if_inet6 r,
  owner @{PROC}/[0-9]*/net/ipv6_route r,
  owner @{PROC}/[0-9]*/net/dev r,
  owner @{PROC}/[0-9]*/net/wireless r,
  owner @{PROC}/[0-9]*/cmdline r,
  owner @{PROC}/[0-9]*/mountinfo r,
  owner @{PROC}/[0-9]*/stat r,
  owner @{PROC}/[0-9]*/task/ r,
  owner @{PROC}/[0-9]*/task/[0-9]*/stat r,
  owner @{PROC}/[0-9]*/status r,
  owner @{PROC}/[0-9]*/statm r,
  owner @{PROC}/[0-9]*/smaps r,
  owner @{PROC}/[0-9]*/fd/ r,
  owner @{PROC}/[0-9]*/fd/** r,
  owner @{PROC}/[0-9]*/environ r,
  owner @{PROC}/[0-9]*/auxv r,

  # system wide configs
  /etc/ r,
  /etc/mime.types r,
  /etc/mailcap r,
  /etc/timezone r,
  /etc/wildmidi/wildmidi.cfg r,
  /etc/udev/udev.conf r,
  /etc/mtab r,
  /etc/fstab r,
  /etc/lsb-release r,

  # tmp and runtime configs access
  owner /tmp/** m,
  owner /var/tmp/** m,
  owner /{,var/}run/**/xauthority r,
  /tmp/.X[0-9]*-lock r,

  # sysfs
  /sys/devices/system/cpu/ r,
  /sys/devices/system/cpu/** r,
  /sys/devices/pci[0-9]*/**/uevent r,

  # executables and extra shared libraries
  /usr/lib{,64}/firefox/** ixr,
  /usr/lib{,64}/libproxy-*/**.so m,
  /usr/bin/ r,
  /usr/bin/which ix,
  /usr/bin/basename ix,
  /usr/bin/dirname ix,
  /usr/bin/pwd ix,
  /sbin/killall5 ix,
  /usr/bin/tr ix,
  /usr/bin/expr ix,

  #TODO:
  /usr/bin/mkfifo Uxr,
  /bin/ps Uxr,
  /bin/uname Uxr,

  # fonts
  /usr/share/fontconfig/ r,
  /usr/share/fontconfig/** r,
  /usr/share/fonts-config/ r,
  /usr/share/fonts-config/** r,
  /usr/share/fonts/ r,
  /usr/share/fonts/** r,
  /usr/share/**/fonts/ r,
  /usr/share/**/fonts/** r,
  /usr/share/*-fonts/ r,
  /usr/share/*-fonts/** r,

  # locales ?
  /usr/share/**/LC_MESSAGES/** r,

  # spellcheck
  /usr/share/myspell/ r,
  /usr/share/myspell/** r,
  /usr/share/hunspell/ r,
  /usr/share/hunspell/** r,

  # Needed for container to work in xul builds
  /usr/lib{,64}/xulrunner-*/plugin-container ixr,

  # per-user firefox configuration
  owner @{HOME}/.{firefox,mozilla}/ rw,
  owner @{HOME}/.{firefox,mozilla}/** rw,
  owner @{HOME}/.{firefox,mozilla}/**/*.{db,parentlock,sqlite}* k,
  owner @{HOME}/.{firefox,mozilla}/plugins/** rm,
  owner @{HOME}/.{firefox,mozilla}/**/plugins/** rm,
  owner @{HOME}/.cache/mozilla/{,firefox/} rw,
  owner @{HOME}/.cache/mozilla/firefox/** rw,
  owner @{HOME}/.cache/mozilla/firefox/**/*.sqlite k,

  #TODO: (firefox restricted with this profile already not able to effectively open files with applications from this configs)
  owner @{HOME}/.local/share/applications/defaults.list r,
  owner @{HOME}/.local/share/applications/mimeapps.list r,
  owner @{HOME}/.local/share/applications/mimeinfo.cache r,
  /var/cache/gio-*/gnome-defaults.list r,
  owner @{HOME}/.config/gtk-3.0/bookmarks r,

  # other user files
  # owner @{HOME}/.thumbnails/*/*.png r,

  # Extensions
  owner @{HOME}/.mozilla/**/extensions/** mixr,
  /usr/share/mozilla/extensions/** ixr,

  ####################
  # exta definitions #
  ####################

  # browsing root (not the subdirs)
  / r,

  # browsing home dir
  # owner @{HOME}/ r,

  # allow downloads to /mnt/downloads/
  /mnt/ r,
  /mnt/downloads/ r,
  /mnt/downloads/** rw,

  # flashgot extension+wget, using xterm (urxwt will be denied)
  /bin/bash ix,
  /bin/sh ix,
  /usr/bin/wget ixr,
  /usr/bin/xterm ixr,
  /usr/lib{,64}/utempter/utempter ixr,
  /dev/pts/** rw,
  /dev/tty rw,
  /dev/ptmx rw,
  /var/run/utmp rwk,
  /var/log/wtmp rwk,
  /etc/wgetrc r,
  /etc/ssl/ r,
  /etc/ssl/** r,
  /usr/share/terminfo/** r,
  /var/cache/libx11/compose/** r,

  # multimedia and flash player with freshwapper
  /usr/lib{,64}/gstreamer-*/gst-plugin-scanner Ux,
  owner @{HOME}/.config/pulse/** r,
  owner @{HOME}/.gstreamer-*/ rw,
  owner @{HOME}/.gstreamer-*/** rw,
  /sys/devices/pci[0-9]*/**/config r,
  /etc/freshwrapper.conf r,
  /etc/vdpau_wrapper.cfg r,
  owner @{HOME}/.config/freshwrapper-data/ rw,
  owner @{HOME}/.config/freshwrapper-data/** rw,

  # TODO:
  deny /usr/lib{,64}/firefox/update.test w,
  deny /usr/lib{,64}/mozilla/extensions/**/ w,
  deny /usr/lib{,64}/xulrunner-addons/extensions/**/ w,
  deny /usr/share/mozilla/extensions/**/ w,
  deny /usr/share/mozilla/ w,
  deny /run/udev/data/** r,
  deny /usr/lib{,64}/firefox/** w,
  deny /usr/lib{,64}/xulrunner-*/** w,
  deny /.suspended r,
  deny /boot/initrd* r,
  deny /boot/vmlinuz* r,
  deny /var/cache/fontconfig/ w,
  deny @{HOME}/.local/share/recently-used.xbel r,
  deny /usr/bin/gconftool-2 x,
}