Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #816980

Bug#858174: Re: Bug#858174: Please provide an AppArmor profile for Firefox

Show all headers | View raw

2017.03.20 11:23, intrigeri rašė:
> Last time I checked, they did include it just like we already do, via
> /usr/share/doc/apparmor-profiles/extras/usr.lib.firefox.firefox in the
> apparmor-profiles package. But I didn't check recently so they might
> very well be shipping another profile in their firefox package nowadays.

Yes, they have profile in firefox package [0]. I'm using it in my
Kubuntu 16.04 desktop, though with some modifications if I recall correctly...

> 1. Find out which profile (if there are several, e.g. a non-upstream
>    one shipped in Ubuntu's firefox package) is the best one, in terms
>    of safety/usability trade-offs and maintenance level.

I guess we could try Ubuntu Firefox profile, it is more advanced compared to
profiles/apparmor/profiles/extras/usr.lib.firefox.firefox in AppArmor source.

> 3. If it's good enough, consider having apparmor-profiles ship it
>    (disabled by default) in /etc/apparmor.d/ instead of
>    /usr/share/doc/apparmor-profiles/extras/, to improve the UX of
>    enabling it and keeping it up-to-date wrt. upstream changes.

But should that profile be a base of Ubuntu Firefox profile (for example) with
./debian/patches on top?

Or "fixed" old "profiles/apparmor/profiles/extras/usr.lib.firefox.firefox",
by sending patches upstream?

Or brand-new Debian-only "profiles/apparmor.d/usr.lib.firefox.firefox" that
is missing in AppArmor upstream?

Or something else?

> 5. Consider enforcing the profile by default: can we do it? is it
>    blocked by something else, like proper desktop notifications
>    offering guidance whenever the AppArmor confinement
>    blocks something?

There is that apparmor-notify, though I haven't tried it myself. I just use
aa-logprof regularly.

I would really like AppArmor to be more mainstream'ish...  If app could
maybe get some kind of feedback directly and inform user that it could not save
that .PDF into ~/ because AppArmor profile denied it, so could you try another
directory instead of just disabling AppAmrmor completely  :-) , please?

Maybe if AppArmor profile had sort of tags or hints, specifying that this
"somepath/** rwk" rule is designed to be user-accesible downloaded/generated
content directory so user should really use that, hinted then by the app itself
(with help of libapparmor or whatever). Anyway, these dreams are out of this bug
scope I guess.

[0] https://bazaar.launchpad.net/~mozillateam/firefox/firefox.xenial/view/head:/debian/usr.bin.firefox.apparmor.14.10

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Bug#858174: Please provide an AppArmor profile for Firefox Ulrike Uhlig <ulrike@debian.org> - 2017-03-19 12:50 +0100
  Bug#858174: Please provide an AppArmor profile for Firefox Mike Hommey <mh@glandium.org> - 2017-03-20 00:20 +0100
    Bug#858174: Please provide an AppArmor profile for Firefox Ulrike Uhlig <ulrike@debian.org> - 2017-03-20 09:00 +0100
      Bug#858174: Please provide an AppArmor profile for Firefox intrigeri <intrigeri@debian.org> - 2017-03-20 10:30 +0100
        Bug#858174: Re: Bug#858174: Please provide an AppArmor profile for Firefox Vincas Dargis <vindrg@gmail.com> - 2017-04-03 20:00 +0200
          Bug#858174: Re: Bug#858174: Please provide an AppArmor profile for Firefox intrigeri <intrigeri@boum.org> - 2017-04-04 07:40 +0200
            Bug#858174: Re: Bug#858174: Please provide an AppArmor profile for Firefox Vincas Dargis <vindrg@gmail.com> - 2017-04-04 18:50 +0200
              Bug#858174: Re: Bug#858174: Please provide an AppArmor profile for Firefox intrigeri <intrigeri@debian.org> - 2017-04-05 08:20 +0200
                Bug#858174: Re: Bug#858174: Please provide an AppArmor profile for Firefox Vincas Dargis <vindrg@gmail.com> - 2017-04-05 18:40 +0200

csiph-web