Firefox | Fabian Moser

To “lock down” Firefox on an openSUSE 11.3 machine, I used the four AppArmor profiles you find below. The first is an openSUSE default profile and the second is based on the openSUSE default profile. My changes include support for PulseAudio sound and the Flash plugin, where the latter is realized with local profiles that are stronger confined than Firefox itself. Finally, I added permission for Zotero requirements.

# /etc/apparmor.d/usr.lib.firefox.firefox.sh
 
#include <tunables/global>
 
/usr/lib/firefox/firefox.sh {
  #include <abstractions/base>
  #include <abstractions/bash>
  #include <abstractions/consoles>
 
  deny capability sys_ptrace,
 
  /bin/basename rix,
  /bin/bash rix,
  /bin/grep rix,
  /etc/magic r,
  /usr/bin/file rix,
  /usr/lib/firefox/firefox px,
  /usr/share/misc/magic.mgc r,
}

# /etc/apparmor.d/usr.lib.firefox.firefox
 
#include <tunables/global>
 
/usr/lib/firefox/firefox {
  #include <abstractions/base>
  #include <abstractions/bash>
  #include <abstractions/consoles>
  #include <abstractions/dbus>
  #include <abstractions/fonts>
  #include <abstractions/gnome>
  #include <abstractions/kde>
  #include <abstractions/nameservice>
  #include <abstractions/pulseaudio>
  #include <abstractions/user-download>
  #include <abstractions/user-write>   
 
  deny /usr/lib/firefox/firefox.sh x,
  deny /usr/lib/mozilla/extensions/*/ w,
 
  /bin/bash ix,
  /bin/uname ix,
 
  /etc/gai.conf r,
  /etc/gnome-vfs-2.0/modules/ r,
  /etc/gre.d/ r,
  /etc/gre.d/* r,
  /etc/mailcap r,
  /etc/mime.types r,
  /etc/mtab r,
  /etc/opt/kde3/share/applications/ r,
  /etc/opt/kde3/share/applications/mimeinfo.cache r,
 
  owner @{HOME}/.ICEauthority r,
  owner @{HOME}/.beagle/ToIndex/* rw,
  owner @{HOME}/.fontconfig/* r,
  owner @{HOME}/.icons/ r,
  owner @{HOME}/.local/share/applications/ r,
  owner @{HOME}/.local/share/applications/* r,
  owner @{HOME}/.local/share/mime/* r,
  owner @{HOME}/.mozilla/extensions/** rw,
  owner @{HOME}/.mozilla/firefox/** rw,
  owner @{HOME}/.mozilla/firefox/**.sqlite* k,
  owner @{HOME}/.mozilla/firefox/**/.parentlock k,
 
  /opt/kde3/share/applications/ r,
  /opt/kde3/share/applications/mimeinfo.cache r,
 
  owner @{PROC}/*/mounts r,
  owner @{PROC}/*/fd/ r,
  @{PROC}/meminfo r,
  @{PROC}/sys/kernel/ngroups_max r,
 
  /usr/bin/tr ix,
  /usr/bin/which ix,
 
  /usr/lib/**.so mr,
  /usr/lib/firefox/firefox rix,
  /usr/lib/libproxy/pxgconf ix,
  /usr/lib/nspluginwrapper/*/linux/npviewer rcx -> npviewer,
  /usr/lib/xulrunner-*/plugin-container cx -> plugin_container,
 
  /usr/local/share/applications/ r,
  /usr/local/share/applications/* r,
  /usr/share/applications/ r,
  /usr/share/applications/* r,
  /usr/share/gvfs/remote-volume-monitors/ r,
  /usr/share/gvfs/remote-volume-monitors/* r,
  /usr/share/locale-bundle/**.mo r,
  /usr/share/mime/**.xml r,
  /usr/share/mozilla/extensions/** r,
  /usr/share/myspell/* r,
 
  /var/cache/gio-2.0/defaults.list r,
  /var/cache/libx11/compose/* r,
  owner /var/run/gdm/*/database r,
 
  profile npviewer {
    #include <abstractions/base>
    #include <abstractions/bash>
    #include <abstractions/consoles>
 
    /bin/bash rix,
    /bin/uname rix,
    /usr/bin/tr rix,
    /usr/bin/which rix,
    /usr/lib/nspluginwrapper/*/linux/npviewer.bin rix,
  }
 
  profile plugin_container {
    #include <abstractions/base>
    #include <abstractions/bash>
    #include <abstractions/consoles>
    #include <abstractions/gnome>
    #include <abstractions/pulseaudio>
 
    deny /etc/passwd r,
    deny @{PROC}/uptime r,
    deny @{HOME}/.mozilla/firefox/profiles.ini r,
 
    /bin/bash ix,
    /bin/grep ix,
    /bin/ps ix,
 
    owner @{PROC}/*/fd/ r,
    owner @{PROC}/*/stat r,
 
    owner /var/run/gdm/*/database r,
    owner @{HOME}/.adobe/Flash_Player/**/ w,
    owner @{HOME}/.adobe/Flash_Player/AssetCache/ r,
    owner @{HOME}/.macromedia/Flash_Player/** rw,
  }
 
  # Zotero-specific rules
  owner @{HOME}/.mozilla/firefox/*/zotero/pdfinfo-Linux-* cx -> zotero_tools,
  owner @{HOME}/.mozilla/firefox/*/zotero/pdftotext-Linux-* cx -> zotero_tools,
  owner @{HOME}/.zoteroIntegrationPipe rw,
  /usr/bin/evince Ux,
  /usr/bin/mkfifo ix,
  profile zotero_tools {
    #include <abstractions/base>
 
    owner @{HOME}/.mozilla/firefox/*/zotero/storage/*/* r,
    owner @{HOME}/.mozilla/firefox/*/zotero/storage/*/.zotero-ft-info w,
    owner @{HOME}/.mozilla/firefox/*/zotero/storage/*/.zotero-ft-cache w,
  }
}

# /etc/apparmor.d/abstractions/pulseaudio
 
/dev/shm/ r,
owner /dev/shm/pulse-shm-* rw,
/dev/snd/*      rw,
 
/etc/alsa-pulse.conf r,
/etc/asound-pulse.conf r,
/etc/pulse/client.conf r,
 
owner @{HOME}/.pulse-cookie rwk,
 
/usr/bin/pulseaudio px,
 
/usr/share/alsa/** r,
/usr/share/sounds/** r,
 
/var/lib/dbus/machine-id r,
 
# vim:syntax=apparmor

# /etc/apparmor.d/usr.bin.pulseaudio
 
#include <tunables/global>
 
/usr/bin/pulseaudio {
  #include <abstractions/base>
}

I’m using Zotero to organise my bibliography. Not only do I store citation information, but I also love the possibility to let it organise the corresponding PDF files. That way I have full-text search and a superb tagging facility for almost everything I read and might need to use and cite later. As a Fedora user, I didn’t have Firefox configured to embed all kind of media into the browser by default. In general I perceive this as an advantage, but in my use-case I have Firefox with Zotero running in full-screen on a separate workspace and want it to manage the screen entirely. And since Evince is the default PDF viewer on Gnome at the moment, I would like it to be embedded into Firefox tabs as I open PDFs from Zotero.

As quick search for the topic brought me to an article in the Ubuntu Forums which solved 90% of the problem. Installing Mozplugger

yum install mozplugger

and raising the priority of Evince as its PDF handler made most of the PDFs open embedded just as intended. However, Zotero seems to assign an unusual MIME type for the PDFs it stores that is “application/octetstream”. Thus to fit my needs, I added that type to the Mozplugger PDF handler

sudo vim /etc/mozpluggerrc

which now reads as

application/pdf:pdf:PDF file
application/x-pdf:pdf:PDF file
text/pdf:pdf:PDF file
text/x-pdf:pdf:PDF file
application/octetstream:pdf:PDF file
        repeat noisy swallow(evince) fill: evince "$file"
#       ACROREAD()
#       repeat noisy swallow(kpdf) fill: kpdf "$file"
#       repeat noisy swallow(Xpdf) fill: xpdf -g +9000+9000 "$file"
#       repeat noisy swallow(okular) fill: okular "$file"
#       GV()
#       repeat noisy fill exits: evince "$file"

Fabian Moser

"as simple as possible, but not simpler"

Tag Archives: Firefox

Secure Firefox with AppArmor

Embed PDFs from Zotero