diff --git a/apparmor.d/groups/browsers/firefox b/apparmor.d/groups/browsers/firefox index 51625ff3..455add5e 100644 --- a/apparmor.d/groups/browsers/firefox +++ b/apparmor.d/groups/browsers/firefox @@ -181,6 +181,7 @@ profile firefox @{exec_path} flags=(attach_disconnected) { owner @{user_cache_dirs}/gstreamer-[0-9]*/registry.*.bin{,.tmp*} rw, owner @{user_config_dirs}/ r, + owner @{user_config_dirs}/gtk-{3,4}.0/assets/*.svg r, owner @{user_config_dirs}/ibus/bus/{,@{hex}-unix{,-wayland}-[0-9]*} r, owner @{user_config_dirs}/mimeapps.list{,.*} rw, diff --git a/apparmor.d/groups/browsers/firefox-kmozillahelper b/apparmor.d/groups/browsers/firefox-kmozillahelper new file mode 100644 index 00000000..25684512 --- /dev/null +++ b/apparmor.d/groups/browsers/firefox-kmozillahelper @@ -0,0 +1,48 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2023 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /{usr/,}lib/mozilla/kmozillahelper +profile firefox-kmozillahelper @{exec_path} { + include + include + include + include + include + include + include + + ptrace (read) peer=firefox, + + @{exec_path} mr, + + /usr/share/hwdata/*.ids r, + /usr/share/icu/[0-9]*.[0-9]*/*.dat r, + /usr/share/kservices5/{,**} r, + /usr/share/mime/ r, + + /etc/xdg/kdeglobals r, + /etc/xdg/kwinrc r, + /etc/xdg/menus/ r, + /etc/xdg/menus/applications-merged/ r, + + owner @{user_cache_dirs}/icon-cache.kcache rw, + owner @{user_cache_dirs}/ksycoca5_* r, + + owner @{user_config_dirs}/kdedefaults/kdeglobals r, + owner @{user_config_dirs}/kdedefaults/kwinrc r, + owner @{user_config_dirs}/kdeglobals r, + owner @{user_config_dirs}/kwinrc r, + + owner @{run}/user/@{uid}/xauth_* rl, + + @{PROC}/sys/kernel/core_pattern r, + + /dev/tty r, + + include if exists +} \ No newline at end of file diff --git a/dists/flags/main.flags b/dists/flags/main.flags index fd6d1c86..2403a08e 100644 --- a/dists/flags/main.flags +++ b/dists/flags/main.flags @@ -98,6 +98,7 @@ fail2ban-client attach_disconnected,complain fail2ban-server attach_disconnected,complain fdisk complain file-roller complain +firefox-kmozillahelper complain firewalld complain flatpak-session-helper complain fsck-ext4 complain