[ubuntu-hardened] [AppArmor] Default Firefox profile: ~/Downloads and ~/Public directory issue.

[Jamie Strandboge]

On 05/06/2014 01:46 PM, Seth Arnold wrote:
> On Tue, May 06, 2014 at 03:43:20PM +0200, Daniel Curtis wrote:
>> It seems to be very important issue. Especially from a
>> security point of view. If someone is a non-english person,
>> then it seems, that AppArmor is not protecting well, Firefox
>> and users home directories (see above). I hope I'm wrong.
> 
> Hello Daniel,
> 
> This is currently not handled well.
> 
> It isn't that AppArmor isn't protecting well -- the policy will be
> enforced and if these directories don't exist because they have localized
> names then in fact the permissions available to Firefox are smaller. But
> it won't work as the user wants, so we should come up with some way to fix
> this.
> 
> There is a thread describing some potential plans here:
> 
> https://lists.ubuntu.com/archives/apparmor/2013-August/004183.html
> 

Actually more came of this than just the thread discussion: XDG user dirs
support is in upstream trunk and in Ubuntu 14.04 via the xdg-user-dirs tunable.
The firefox profile in Ubuntu 14.04 does not current take advantage of this
tunable though. How to make this work with firefox on Ubuntu 14.04 would be to:

 1. update /etc/apparmor.d/tunables/xdg-user-dirs.d/site.local to your taste.
    Eg:
    @{XDG_DOWNLOAD_DIR}+="YourDownloadDir"
    @{XDG_PUBLICSHARE_DIR}+="YourPublicDir"

 2. adjust /etc/apparmor.d/local/usr.bin.firefox to use the XDG tunables:
    owner @{HOME}/@{XDG_PUBLICSHARE_DIR}/ r,
    owner @{HOME}/@{XDG_PUBLICSHARE_DIR}/* r,
    owner @{HOME}/@{XDG_DOWNLOAD_DIR}/ r,
    owner @{HOME}/@{XDG_DOWNLOAD_DIR}/* rw,

 3. reload the firefox profile with:
    sudo apparmor_parser -r /etc/apparmor.d/usr.bin.firefox

-- 
Jamie Strandboge                 http://www.ubuntu.com/

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-hardened/attachments/20140506/4871c597/attachment.pgp>