mirror of
https://gitlab.com/apparmor/apparmor.git
synced 2025-03-08 18:31:03 +01:00
77c2e27e6c
The updated rule covers the old-style /usr/lib/firefox/firefox.sh
wrapper and the current /usr/lib/firefox{,-esr}/firefox{,-esr} paths.
It is a tiny bit wide but let's lean on the side of compatibility with
whatever similar paths are used in the future. It doesn't grant access
to anything we don't want on a current Debian sid system.
42 lines
1.6 KiB
Text
42 lines
1.6 KiB
Text
# vim:syntax=apparmor
|
|
#
|
|
# abstraction for allowing access to graphical browsers in Ubuntu
|
|
#
|
|
# Users of this abstraction need to #include the ubuntu-helpers abstraction
|
|
# in the toplevel profile. Eg:
|
|
# #include <abstractions/ubuntu-helpers>
|
|
|
|
/usr/bin/arora Cx -> sanitized_helper,
|
|
/usr/bin/conkeror Cx -> sanitized_helper,
|
|
/usr/bin/dillo Cx -> sanitized_helper,
|
|
/usr/bin/Dooble Cx -> sanitized_helper,
|
|
/usr/bin/epiphany Cx -> sanitized_helper,
|
|
/usr/bin/epiphany-browser Cx -> sanitized_helper,
|
|
/usr/bin/epiphany-webkit Cx -> sanitized_helper,
|
|
/usr/lib/fennec-*/fennec Cx -> sanitized_helper,
|
|
/usr/bin/galeon Cx -> sanitized_helper,
|
|
/usr/bin/kazehakase Cx -> sanitized_helper,
|
|
/usr/bin/konqueror Cx -> sanitized_helper,
|
|
/usr/bin/midori Cx -> sanitized_helper,
|
|
/usr/bin/netsurf Cx -> sanitized_helper,
|
|
/usr/bin/prism Cx -> sanitized_helper,
|
|
/usr/bin/rekonq Cx -> sanitized_helper,
|
|
/usr/bin/seamonkey Cx -> sanitized_helper,
|
|
/usr/bin/sensible-browser Pixr,
|
|
|
|
/usr/bin/chromium{,-browser} Cx -> sanitized_helper,
|
|
/usr/lib/chromium{,-browser}/chromium{,-browser} Cx -> sanitized_helper,
|
|
|
|
# this should cover all firefox browsers and versions (including shiretoko
|
|
# and abrowser)
|
|
/usr/bin/firefox Cxr -> sanitized_helper,
|
|
/usr/lib/firefox*/firefox* Cx -> sanitized_helper,
|
|
|
|
# Iceweasel
|
|
/usr/bin/iceweasel Cxr -> sanitized_helper,
|
|
/usr/lib/iceweasel/iceweasel Cx -> sanitized_helper,
|
|
|
|
# some unpackaged, but popular browsers
|
|
/usr/lib/icecat-*/icecat Cx -> sanitized_helper,
|
|
/usr/bin/opera Cx -> sanitized_helper,
|
|
/opt/google/chrome/google-chrome Cx -> sanitized_helper,
|