apparmor profile for Firefox should allow /dev/video0 access

[Guillaume]

Hello,

With Firefox 6.0.2 apparmor profile enabled on Natty, Flash and Google Talk can't access the webcam. If I put Firefox in complain mode, it works but I get this kind of message:

[ 1856.852807] type=1400 audit(1317154329.250:137): apparmor="DENIED" operation="open" parent=4390 profile="/usr/lib/firefox-6.0.2/firefox{,*[^s][^h]}" name="/dev/video0" pid=4447 comm="npviewer.bin" requested_mask="rw" denied_mask="rw" fsuid=1026 ouid=0

Best regards

Guillaume

[Jamie Strandboge (jdstrand)]

Thank you for using and reporting a bug. As a workaround, you can add the following to /etc/apparmor.d/local/usr.bin.firefox:
  /dev/video0 rw,

Then do:
$ sudo apparmor_parser -r /etc/apparmor.d/usr.bin.firefox

[Jamie Strandboge (jdstrand)]

I don't think this should be allowed by default, but do think it could be part of a googletalk profile or flash profile. User's who require this for now should add the access to /etc/apparmor.d/local/usr.bin.firefox. A future update may provide an easier method to enable this, or even a commented out entry.