Firefox profile has too much access

[Vincas Dargis]

usr.bin.firefox in Kubuntu 16.04.1 profile has some fine grained rules defined concerning home directory, such as:

  owner @{HOME}/ r,
  ...
  owner @{HOME}/.{firefox,mozilla}/ rw,
  owner @{HOME}/.{firefox,mozilla}/** rw,
  owner @{HOME}/.{firefox,mozilla}/**/*.{db,parentlock,sqlite}* k,
  owner @{HOME}/.{firefox,mozilla}/**/plugins/** mr,
  owner @{HOME}/.{firefox,mozilla}/plugins/** mr,
  owner @{HOME}/Downloads/ r,
  owner @{HOME}/Downloads/* rw,
  owner @{HOME}/Public/ r,
  owner @{HOME}/Public/* r,
  ...

It *looks* strict at first sight, but I still can read some arbitrary files from my home (sub)directory, such as
/home/vincas/talkless.pqi
/home/vincas/code/something...

It *does* protect .ssh/id_rsa.pub and such, for example, so denies kinda works from "private-files-strict" include.

I've checked apparor_parser -d -d, I can see some @{HOME}/** rw... rules, though it looks like it should belong to browser_java, browser_openjdk subprofiles, but it looks like if they are "leaking" somehow for main process.

I'm attaching apparmor_parser -d -d and -p outputs.

[Simon Déziel (sdeziel)]

This comes from the inclusion of abstractions/ubuntu-browsers.d/firefox that in turn includes /etc/apparmor.d/abstractions/ubuntu-browsers.d/user-files:

  # Allow read to all files user has DAC access to and write access to all
  # files owned by the user in $HOME.
  @{HOME}/ r,
  @{HOME}/** r,
  owner @{HOME}/** w,

[Vincas Dargis (talkless)]

Thanks Simon, now I did some changes in "user-files":

  # Allow read to all files user has DAC access to and write access to all
  # files owned by the user in $HOME.
  @{HOME}/ r,

  #Changed by me, do not allow free access to whole home!
  #@{HOME}/** r,
  #owner @{HOME}/** w,

  # For uploading files from Desktop:
  owner @{HOME}/Desktop/ r,
  owner @{HOME}/Desktop/** r,

  # For downloading:
  owner @{HOME}/Downloads/ r,
  owner @{HOME}/Downloads/** rwk,

Now Firefox is confined enough, for my taste at least.

So it's like.. no a bug, it's by design? Though these explicit real rules in usr.bin.firefox looks very misleading in this case.

[Vincas Dargis (talkless)]

explicit real = explicit read, sorry for typo.

[Simon Déziel (sdeziel)]

On 2016-08-05 11:59 AM, Vincas Dargis wrote:
> So it's like.. no a bug, it's by design? Though these explicit real
> rules in usr.bin.firefox looks very misleading in this case.

I agree with you, the profile should be tighten up. Since the profile is
disabled by default, I think the regression potential is rather low and
the security benefits are high.

I'd like to hear from other users of the profile though.