[apparmor] [profile] Firefox: "DENIED", requested/denied_mask="r" for /proc/*/net/arp.

[daniel curtis]

Hi Christian

Thanks - in such situation I will use this rule:

@{PROC}/@{pid}/net/arp r,

But with "rw", because I've noticed a new log entry today. It's about arp
however this time Firefox wants:

Nov 19 11:16:07 t4 kernel: [  581.553928] type=1400
audit(1479550567.774:51): apparmor="DENIED" operation="open" parent=3164
profile="/usr/lib/firefox/firefox{,*[^s][^h]}" name="/dev/nvidiactl"
pid=3167 comm="firefox" requested_mask="rw" denied_mask="rw" fsuid=1000
ouid=0

There is also two entries, but requested_ and denied_ mask is "r". So I
think the best rule to use is:

@{PROC}/@{pid}/net/arp rw,

Also more often appears entry related to /dev/nvidiactl (DENIED). I've
noticed it after Firefox update to version 49. Previously, this message
appeared very rarely.

Best regards.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ubuntu.com/archives/apparmor/attachments/20161119/b11ffe51/attachment.html>