[ubuntu-hardened] AppArmor profile for a plugin-container process.

[Seth Arnold]

On Tue, Dec 10, 2013 at 06:36:48PM +0100, Daniel Curtis wrote:
> Hello everyone
> 
> It is normal, that after creating and putting a plugin-container
> profile into 'enforce' mode, 'aa-status' command shows
> something like this, even with enabled a website such as
> YouTube etc.?
> 
> (the remaining apparmor profiles)
> /usr/lib/firefox/plugin-container
> (...)
> 3 processes are in enforce mode.
>    /sbin/dhclient (1029)
>    /usr/lib/firefox/firefox{,*[^s][^h]} (2931)
>    /usr/lib/firefox/firefox{,*[^s][^h]} (2976)
> 
> I think there should be '/usr/lib/firefox/plugin-container'
> instead of a two entries regarding to Firefox, because of
> flash being in use. I'm right or I'm wrong?
> 
> There isn't anything strange in a log files (e.g. '/var/log/syslog).
> No errors about 'plugin-container' profile (there are only
> notices about name, operation - 'profile_replace' or comm
> - 'apparmor_parser'). Of course, I've tried to restart/reload
> AppArmor and all profiles, but nothing has changed.

Hello Daniel,

Note that for a process confined by the firefox profile to transition to
the /usr/lib/firefox/plugin-container profile, your firefox profile will
need a rule like this:

  /usr/lib/firefox/plugin-container Px,

Of course, Firefox will also need to exec() this executable in order to
run a plugin. I do not know Firefox's implementation details well enough
to tell you if it does this correctly for a rule like this to work. (It
might also choose to fork, mmap the file, and jump to a specific symbol,
for example.)

If you can share your firefox profile we might be able to give a more
concrete answer.

I hope this helps,
Thanks
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 490 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-hardened/attachments/20131210/9e3f0ad6/attachment.pgp>