Ubuntu
firefox package

  1. Bug #1662501
  2. Comment #5

Comment 5 for bug 1662501

Revision history for this message
Jamie Strandboge (jdstrand) wrote : Re: AppArmor profile for ubuntu-browsers allows too much read access

Thank you for using Ubuntu and filing a bug!

While /etc/apparmor.d/abstractions/ubuntu-browsers.d/user-files is shipped by apparmor, it is actually /etc/apparmor.d/abstractions/ubuntu-browsers.d/firefox that #include's it, and this file is managed by the firefox package, so moving this bug there.

As for what the profile is intended to protect against and why it works the way it does, please see https://wiki.ubuntu.com/SecurityTeam/FAQ#Firefox_AppArmor_profile

This issue was discussed on IRC with the reporter. Here is the summary:
- the firefox profile is disabled by default
- the firefox profile aims for 'usable security' such that if the profile is enabled, the browser is expected to generally work in the manner that people would expect
- the firefox profile can be adjusted to remove the user-files abstraction either by editing /etc/apparmor.d/abstractions/ubuntu-browsers.d/firefox or using 'aa-update-browser'

In Ubuntu, we aim for 'usable security' because we don't want people to turn AppArmor off. The intent of the profile is that when enabled, people get some protections (eg, code execution) but can access their files using normal browser workflows. Security-minded individuals can then fine-tune the profile to make it more strict.

Vlad made the point in that if the profile is turned off by default, then it can be made very strict with people adding to the profile what they want. As such, adjusting the bug description and marking as Wishlist.

Note: IMHO snaps will be the way forward with browsers. Upstream is committing to shipping firefox as a snap and that snap will have stricter confinement than the AppArmor profile in the firefox package of Ubuntu currently (eg, stricter AppArmor policy, seccomp, etc). Of course, Mozilla will also want usable security and they will use the transitional 'home' interface which grants access to files in a similar fashion as the 'user-files' abstraction, but security-minded individuals can use 'snap disconnect firefox:home' to further restrict it. The long term goal is that the snap will used on Ubuntu Personal or other distributions and use mir or wayland instead of X and with file choosers that understand the sandbox limitations and work with the OS to avoid using the transitional 'home' interface to provide a very secure usable browsing experience.