git » apparmor » master » tree

[master] / usr.bin.iceweasel 

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
# Alberto - 2014-03-08
# vim:syntax=apparmor

#include <tunables/global>

/usr/lib/iceweasel/iceweasel {
  #include <abstractions/base>
  #include <abstractions/nameservice>
  #include <abstractions/user-tmp>
  #include <abstractions/fonts>
  #include <abstractions/audio>
  #include <abstractions/X>

  # Access iceweasel files.
  /usr/lib/mozilla/** r,
  /usr/lib/iceweasel/** r,
  /etc/iceweasel/** r,

  # Make browsing directories work
  / r,
  /**/ r,

  # Allow access to documentation and other files the user may want to look
  # at in /usr
  /usr/{include,share,src}** r,

  # Default profile allows downloads to ~/Downloads and uploads from ~/Public
  owner @{HOME}/ r,
  owner @{HOME}/Public/ r,
  owner @{HOME}/Public/* r,
  owner @{HOME}/Downloads/ r,
  owner @{HOME}/Downloads/* rw,

  # Helpers
  /usr/bin/xdg-open ixr,
  /usr/bin/gnome-open ixr,
  /usr/bin/gvfs-open ixr,

  # Configuration and caches.
  owner @{HOME}/.mozilla/ rw,
  owner @{HOME}/.mozilla/** rwk,
  owner @{HOME}/.cache/ rw,
  owner @{HOME}/.cache/** rwk,
  owner @{HOME}/.gnome2/ rw,
  owner @{HOME}/.gnome2/** rw,
  owner @{HOME}/.gnome2_private/ rw,
  owner @{HOME}/.gnome2_private/** rw,
  owner @{HOME}/.config/user-dirs.dirs r,

  owner /run/user/** rwk,

  # System level stuff.
  /proc/*/** r,
  /usr/lib/** rm,
  /var/lib/dbus/machine-id r,
  /etc/gnome-vfs-2.0/modules/* r,
  /etc/drirc r,
  /etc/mozpluggerrc r,
  /etc/mime.types r,
  /etc/mailcap r,
  /sys/devices/system/cpu/present r,
  /etc/udev/udev.conf r,

  # It needs to run m4 when ran for the first time.
  /usr/bin/m4 ixr,

  # Run dbus-launch, which runs dbus-daemon if it's not there already.
  # We trust it enough to run unrestricted, but after cleaning the
  # environment.
  /usr/bin/dbus-launch Uxr,

  # Run xulrunner/plugin-container.
  # Note we need to use lowercase 'c' as Firefox *will* do tricks with the
  # environment. It is still under the sub-profile, though.
  /usr/lib/xulrunner-*/plugin-container cxr -> plugin_container,
  /usr/lib/iceweasel/xulrunner/plugin-container cxr -> plugin_container,
  /usr/lib/iceweasel/plugin-container cxr -> plugin_container,
  /usr/lib/iceweasel/xulrunner/** rm,

  profile plugin_container {
    #include <abstractions/base>
    #include <abstractions/user-tmp>
    #include <abstractions/fonts>
    #include <abstractions/audio>
    #include <abstractions/X>

    @{PROC}/[0-9]*/cmdline r,

    # The plugin container needs to run small scripts.
    # Let it get a shell, a normal ps, and grep; which seems to be enough.
    /bin/dash ixr,
    /bin/ps Uxr,
    /bin/grep ixr,

    # Files it really needs to access (including executable mappings to the
    # xulrunner libraries).
    /usr/lib/iceweasel/xulrunner/** rm,
    /usr/lib/xulrunner-*/** rm,
    /usr/lib/iceweasel/plugin-container rm,

    # Read, but not write, from our profile.
    owner @{HOME}/.mozilla/** r,
    /etc/passwd r,

    # The flash plugin needs these, both to the directory to create it if it
    # doesn't exist, and full access within.
    # Note this is the only special place it can write to (other than tmp,
    # audio, etc.).
    owner @{HOME}/.adobe/ rw,
    owner @{HOME}/.adobe/** rw,
    owner @{HOME}/.macromedia/ rw,
    owner @{HOME}/.macromedia/** rw,

    # Miscellaneous things that are required and safe to read.
    /usr/share/icons/** r,
    /usr/share/themes/** r,
    /etc/vdpau_wrapper.cfg r,
    /etc/machine-id r,

    /etc/ssl/openssl.cnf r,
    /usr/lib/ssl/openssl.cnf r,

    # We're not giving it full nameservice permissions, but it needs these.
    /etc/nsswitch.conf r,
    /etc/group r,
    /etc/host.conf r,
    /etc/resolv.conf r,
    /etc/hosts r,
  }
}