Data hosted with ♥ by Pastebin.com - Download Raw - See Original
  1. # Last Modified: Wed Sep 16 06:53:57 2015
  2. @{MOZ_LIBDIR} = /usr/lib/firefox
  3.  
  4. #include <tunables/global>
  5.  
  6. # vim:syntax=apparmor
  7. # Author: Jamie Strandboge <jamie@canonical.com>
  8. # Declare an apparmor variable to help with overrides
  9. # We want to confine the binaries that match:
  10. # /usr/lib/firefox/firefox
  11. # /usr/lib/firefox/firefox
  12. # but not:
  13. # /usr/lib/firefox/firefox.sh
  14.  
  15.  
  16. /usr/lib/firefox/firefox{,*[^s][^h]} {
  17. #include <abstractions/audio>
  18. #include <abstractions/cups-client>
  19. #include <abstractions/dbus>
  20. #include <abstractions/dbus-accessibility>
  21. #include <abstractions/dbus-session>
  22. #include <abstractions/gnome>
  23. #include <abstractions/ibus>
  24. #include <abstractions/nameservice>
  25. #include <abstractions/openssl>
  26. #include <abstractions/p11-kit>
  27. #include <abstractions/ubuntu-browsers.d/firefox>
  28. #include <local/usr.bin.firefox>
  29.  
  30. network inet stream,
  31. network inet6 stream,
  32.  
  33. deny /.suspended r,
  34. deny /boot/initrd.img* r,
  35. deny /boot/vmlinuz* r,
  36. deny /run/udev/data/** r,
  37. deny /usr/bin/gconftool-2 x,
  38. deny /usr/lib/firefox-addons/** w,
  39. deny /usr/lib/mozilla/extensions/**/ w,
  40. deny /usr/lib/xulrunner-*/components/*.tmp w,
  41. deny /usr/lib/xulrunner-addons/** w,
  42. deny /usr/lib/xulrunner-addons/extensions/**/ w,
  43. deny /usr/share/mozilla/ w,
  44. deny /usr/share/mozilla/extensions/**/ w,
  45. deny /var/cache/fontconfig/ w,
  46. deny @{HOME}/.local/share/recently-used.xbel r,
  47. deny @{MOZ_LIBDIR}/** w,
  48. deny @{MOZ_LIBDIR}/update.test w,
  49.  
  50. / r,
  51. /**/ r,
  52. /bin/ps rUx,
  53. /bin/uname rUx,
  54. /bin/which rix,
  55. /etc/ r,
  56. /etc/firefox*/ r,
  57. /etc/firefox*/** r,
  58. /etc/fstab r,
  59. /etc/gre.d/ r,
  60. /etc/gre.d/* r,
  61. /etc/lsb-release r,
  62. /etc/mailcap r,
  63. /etc/mime.types r,
  64. /etc/mtab r,
  65. /etc/timezone r,
  66. /etc/udev/udev.conf r,
  67. /etc/wildmidi/wildmidi.cfg r,
  68. /etc/xdg/*buntu/applications/defaults.list r,
  69. /etc/xfce4/defaults.list r,
  70. /etc/xul-ext/** r,
  71. /etc/xulrunner-2.0*/ r,
  72. /etc/xulrunner-2.0*/** r,
  73. /opt/ r,
  74. /opt/** r,
  75. /sbin/killall5 rix,
  76. /sys/devices/pci*/**/{busnum,idVendor,idProduct} r,
  77. /sys/devices/pci[0-9]*/**/uevent r,
  78. /sys/devices/platform/**/uevent r,
  79. /sys/devices/system/cpu/ r,
  80. /sys/devices/system/cpu/** r,
  81. /sys/devices/virtual/block/dm-1/uevent r,
  82. owner /tmp/** m,
  83. /tmp/.X[0-9]*-lock r,
  84. /usr/ r,
  85. /usr/** r,
  86. /usr/bin/basename rix,
  87. /usr/bin/dirname rix,
  88. /usr/bin/expr ix,
  89. /usr/bin/mkfifo rUx,
  90. /usr/bin/pwd rix,
  91. /usr/bin/tr rix,
  92. /usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-plugin-scanner rix,
  93. /usr/lib/xulrunner-*/plugin-container rix,
  94. /usr/share/xubuntu/applications/defaults.list r,
  95. owner /var/tmp/** m,
  96. owner /{,var/}run/shm/shmfd-* rw,
  97. owner @{HOME}/ r,
  98. owner @{HOME}/.cache/mozilla/firefox/** rw,
  99. owner @{HOME}/.cache/mozilla/firefox/**/*.sqlite k,
  100. owner @{HOME}/.cache/mozilla/{,firefox/} rw,
  101. owner @{HOME}/.gnome2/firefox*-bin-* rw,
  102. owner @{HOME}/.local/share/applications/defaults.list r,
  103. owner @{HOME}/.local/share/applications/mimeapps.list r,
  104. owner @{HOME}/.local/share/applications/mimeinfo.cache r,
  105. owner @{HOME}/.mozilla/**/extensions/** mrix,
  106. owner @{HOME}/.thumbnails/*/*.png r,
  107. owner @{HOME}/.{firefox,mozilla}/ rw,
  108. owner @{HOME}/.{firefox,mozilla}/** rw,
  109. owner @{HOME}/.{firefox,mozilla}/**/*.{db,parentlock,sqlite}* k,
  110. owner @{HOME}/.{firefox,mozilla}/**/plugins/** mr,
  111. owner @{HOME}/.{firefox,mozilla}/plugins/** mr,
  112. owner @{HOME}/Downloads/ r,
  113. owner @{HOME}/Downloads/* rw,
  114. owner @{HOME}/Public/ r,
  115. owner @{HOME}/Public/* r,
  116. @{MOZ_LIBDIR}/** rix,
  117. @{PROC}/ r,
  118. owner @{PROC}/[0-9]*/auxv r,
  119. @{PROC}/[0-9]*/cmdline r,
  120. owner @{PROC}/[0-9]*/environ r,
  121. @{PROC}/[0-9]*/mountinfo r,
  122. @{PROC}/[0-9]*/net/dev r,
  123. @{PROC}/[0-9]*/net/if_inet6 r,
  124. @{PROC}/[0-9]*/net/ipv6_route r,
  125. @{PROC}/[0-9]*/net/wireless r,
  126. owner @{PROC}/[0-9]*/smaps r,
  127. @{PROC}/[0-9]*/stat r,
  128. owner @{PROC}/[0-9]*/statm r,
  129. @{PROC}/[0-9]*/status r,
  130. owner @{PROC}/[0-9]*/task/[0-9]*/stat r,
  131. @{PROC}/filesystems r,
  132. @{PROC}/sys/vm/overcommit_memory r,
  133.  
  134. }