You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

128 lines
3.4 KiB

#include <tunables/global>
/usr/lib/firefox/firefox {
#include <abstractions/base>
#include <abstractions/mesa>
#include <abstractions/nameservice>
#include <abstractions/ubuntu-browsers.d/ubuntu-integration>
#include <abstractions/gnome>
# If you want audio then enable this.
# #include <abstractions/audio>
# /usr/bin/jackd mrix,
network netlink raw,
network tcp,
network udp,
deny /etc/host.conf r,
deny /etc/hosts r,
deny /etc/nsswitch.conf r,
deny /etc/passwd r,
deny /etc/group r,
deny /etc/mailcap r,
deny /etc/machine-id r,
deny /var/lib/dbus/machine-id r,
/dev/ r,
/dev/shm/ r,
# SSL certificates
/etc/ca-certificates/trust-source/ r,
/etc/ca-certificates/trust-source/anchors/ r,
/etc/ca-certificates/trust-source/blacklist/ r,
/usr/bin/bash ix,
/usr/bin/firefox r,
/usr/lib/firefox/firefox mrix,
/usr/share/gtk-3.0/settings.ini r,
/usr/share/icons/ r,
/usr/share/pixmaps/ r,
owner /dev/shm/org.mozilla.ipc.* rw,
owner @{HOME}/.ICEauthority r,
owner @{HOME}/.Xauthority r,
owner @{HOME}/.mozilla/ r,
owner @{HOME}/.mozilla/* r,
owner @{HOME}/.mozilla/firefox/ rw,
owner @{HOME}/.mozilla/firefox/** rwk,
owner @{HOME}/.mozilla/firefox/*.default/ rwk,
owner @{HOME}/.mozilla/firefox/*.default/** rwk,
owner @{HOME}/.mozilla/firefox/profiles.ini r,
owner @{HOME}/.mozilla/firefox/*.default/extensions/ rwk,
owner @{HOME}/.mozilla/firefox/*.default/extensions/** rwk,
owner @{HOME}/.cache/mozilla/ r,
owner @{HOME}/.cache/mozilla/firefox/ rw,
owner @{HOME}/.cache/mozilla/firefox/** rwk,
owner @{HOME}/.cache/mozilla/firefox/*.default/ rwk,
owner @{HOME}/.cache/mozilla/firefox/*.default/** rwk,
owner @{HOME}/.cache/mozilla/firefox/*.default/startupCache/ rwk,
owner @{HOME}/.cache/mozilla/firefox/*.default/startupCache/* rwk,
owner @{HOME}/Downloads/ r,
owner @{HOME}/Downloads/* rw,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/stat r,
owner @{PROC}/@{pid}/status r,
owner @{PROC}/@{pid}/task/*/stat r,
@{PROC}/sys/kernel/random/uuid r,
/etc/mailcap r,
/etc/mime.types r,
/usr/share/ r,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/mime/ r,
/usr/share/themes/ r,
/usr/share/applications/** rk,
/usr/share/gnome/applications/ r,
/usr/share/gnome/applications/kde4/ r,
/usr/share/poppler/cMap/ r,
/sys/devices/system/cpu/ r,
/sys/devices/system/cpu/present r,
/sys/devices/system/node/ r,
/sys/devices/system/node/node[0-9]*/meminfo r,
deny /sys/devices/virtual/block/*/uevent r,
/etc/udev/udev.conf r,
/run/udev/data/+pci:* r,
/sys/devices/pci[0-9]*/**/uevent r,
owner /{dev,run}/shm/shmfd-* rw,
owner /{dev,run}/shm/org.chromium.* rw,
deny /dev/dri/** rwklx,
# Silence denial logs about permissions we don't need
deny /dev/dri/ rwklx,
deny @{HOME}/.cache/fontconfig/ rw,
deny @{HOME}/.cache/fontconfig/** rw,
deny @{HOME}/.config/gtk-2.0/ rw,
deny @{HOME}/.config/gtk-2.0/** rw,
deny @{PROC}/@{pid}/net/route r,
deny /sys/devices/system/cpu/cpufreq/policy[0-9]*/cpuinfo_max_freq r,
deny /sys/devices/system/cpu/*/cache/index[0-9]*/size r,
# Silence denial logs about PulseAudio
deny /etc/pulse/client.conf r,
deny /usr/bin/pulseaudio x,
# KDE 4
owner @{HOME}/.kde/share/config/* r,
# Xfce4
/etc/xfce4/defaults.list r,
/usr/share/xfce4/applications/ r,
owner /usr/lib/firefox/fonts/** rw,
owner /usr/share/fonts/** rw,
}