Commit 479b8f53 authored by intrigeri's avatar intrigeri
Browse files

Merge branch 'AppArmor-updates-for-current-Debian' into 'main' 

AppArmor: various updates including 1 important fix for Debian Trixie

See merge request !24
parents a734238b 9eb8686d

apparmor/torbrowser.Browser.firefox

+7 −0
Changes for apparmor/torbrowser.Browser.firefox: 7 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -13,6 +13,8 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} { 
  #include if exists <abstractions/vulkan>

  #include if exists <abstractions/dbus-session-strict>



  userns,



  deny capability sys_ptrace,



  # Uncomment the following lines if you want to give the Tor Browser read-write
@@ -94,6 +96,10 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} { 
  owner @{torbrowser_home_dir}/TorBrowser/Tor/*.so.* mr,

  owner @{torbrowser_home_dir}/TorBrowser/Tor/libstdc++/*.so mr,

  owner @{torbrowser_home_dir}/TorBrowser/Tor/libstdc++/*.so.* mr,

  owner @{torbrowser_home_dir}/vaapitest ix,



  # intel-media-driver

  /etc/igfx_user_feature*.txt r,



  # parent Firefox process when restarting after upgrade, Web Content processes

  owner @{torbrowser_firefox_executable} pxmr -> torbrowser_firefox,
@@ -121,6 +127,7 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} { 
  /sys/devices/system/node/ r,

  /sys/devices/system/node/node[0-9]*/meminfo r,

  /sys/fs/cgroup/cpu,cpuacct/{,user.slice/}cpu.cfs_quota_us r,

  /sys/fs/cgroup/user.slice/user-[0-9]*.slice/user@[0-9]*.service/app.slice/app-gnome-torbrowser-[0-9]*.scope/cpu.max r,

  deny /sys/class/input/ r,

  deny /sys/devices/virtual/block/*/uevent r,