CMXSL.org/package-helpers-cmxsl
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

apparmor: add unconfined profiles for abrowser and icedove.

Browse source
This commit is contained in:
Luis Guzmán 2024-08-22 05:12:34 +00:00
parent 45b150b801
commit 8233f4de21
4 changed files with 188 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

27
helpers/DATA/apparmor/update-profile-extra-firefox-sh.patch Normal file
View file

@ -0,0 +1,27 @@
diff --git a/profiles/apparmor/profiles/extras/firefox.sh b/profiles/apparmor/profiles/extras/firefox.sh
index fb75c5b6..83a7404c 100644
--- a/profiles/apparmor/profiles/extras/firefox.sh
+++ b/profiles/apparmor/profiles/extras/firefox.sh
@@ -22,3 +22,22 @@ profile firefox.sh /usr/lib/firefox/firefox.sh {
# Site-specific additions and overrides. See local/README for details.
include if exists <local/firefox.sh>
}
+
+profile firefox.sh /usr/lib/abrowser/firefox.sh {
+ include <abstractions/base>
+ include <abstractions/bash>
+ include <abstractions/consoles>
+
+ deny capability sys_ptrace,
+
+ /{usr/,}bin/basename rix,
+ /{usr/,}bin/bash rix,
+ /{usr/,}bin/grep rix,
+ /etc/magic r,
+ /usr/bin/file rix,
+ /usr/lib/abrowser/abrowser px,
+ /usr/share/misc/magic.mgc r,
+
+ # Site-specific additions and overrides. See local/README for details.
+ include if exists <local/firefox.sh>
+}