2

I am using the default AppArmor Firefox profile, which is supposed to only allow downloads to be saved to ~/Downloads. However, I can still download to any location within my home directory. I checked that everything was loaded and enforced. For test purposes, I added an explicit deny deny @{HOME}/Dropbox/** w and reloaded. That worked, I can no longer save anything anywhere within the Dropbox directory. I removed my test deny and commented out the 'Default profile allows downloads to ... and uploads from ...' section to see what happens:

#owner @{HOME}/ r,
#owner @{HOME}/Public/ r,
#owner @{HOME}/Public/* r,
#owner @{HOME}/Downloads/ r,
#owner @{HOME}/Downloads/* rw,

As suspected, nothing changed. I figured it must be some accidental allow on the home directory. I reset my changes and tried to find all lines with HOME related to the Firefox profile:

grep 'HOME' $(grep include usr.bin.firefox | sed 's/^.*<\(.*\)>.*/\1/g') usr.bin.firefox

abstractions/audio:owner @{HOME}/.esd_auth r,
abstractions/audio:owner @{HOME}/.asoundrc r,
abstractions/audio:owner @{HOME}/.cache/event-sound-cache.* rwk,
abstractions/audio:owner @{HOME}/.pulse-cookie rwk,
abstractions/audio:owner @{HOME}/.pulse/ rw,
abstractions/audio:owner @{HOME}/.pulse/* rwk,
abstractions/audio:owner @{HOME}/.config/pulse/cookie rwk,
abstractions/audio:owner @{HOME}/.alsoftrc r,
abstractions/cups-client:  owner @{HOME}/.cups/client.conf r,
abstractions/cups-client:  owner @{HOME}/.cups/lpoptions r,
abstractions/gnome:  owner @{HOME}/.gnome/Gnome            r,
abstractions/gnome:  owner @{HOME}/.gtk                    r,
abstractions/gnome:  owner @{HOME}/.gtkrc                  r,
abstractions/gnome:  owner @{HOME}/.gtkrc-2.0              r,
abstractions/gnome:  owner @{HOME}/.gtk-bookmarks          r,
abstractions/gnome:  owner @{HOME}/.themes/                r,
abstractions/gnome:  owner @{HOME}/.themes/**              r,
abstractions/gnome:  owner @{HOME}/.config/gtk-2.0/**                  r,
abstractions/gnome:  owner @{HOME}/.config/gtk-2.0/gtkfilechooser.ini* rw,
abstractions/gnome:  owner @{HOME}/.gconfd/lock/*                      r,
abstractions/gnome:  owner @{HOME}/.gnome/application-info             r,
abstractions/gnome:  owner @{HOME}/.fonts.cache-*    rwl,
abstractions/ibus:  owner @{HOME}/.config/ibus/ r,
abstractions/ibus:  owner @{HOME}/.config/ibus/bus/ rw,
abstractions/ibus:  owner @{HOME}/.config/ibus/bus/* rw,
usr.bin.firefox:  owner @{HOME}/.local/share/applications/defaults.list r,
usr.bin.firefox:  owner @{HOME}/.local/share/applications/mimeapps.list r,
usr.bin.firefox:  owner @{HOME}/.local/share/applications/mimeinfo.cache r,
usr.bin.firefox:  deny @{HOME}/.local/share/recently-used.xbel r,
usr.bin.firefox:  owner @{HOME}/.thumbnails/*/*.png r,
usr.bin.firefox:  owner @{HOME}/ r,
usr.bin.firefox:  owner @{HOME}/Public/ r,
usr.bin.firefox:  owner @{HOME}/Public/* r,
usr.bin.firefox:  owner @{HOME}/Downloads/ r,
usr.bin.firefox:  owner @{HOME}/Downloads/* rw,
usr.bin.firefox:  owner @{HOME}/.{firefox,mozilla}/ rw,
usr.bin.firefox:  owner @{HOME}/.{firefox,mozilla}/** rw,
usr.bin.firefox:  owner @{HOME}/.{firefox,mozilla}/**/*.{db,parentlock,sqlite}* k,
usr.bin.firefox:  owner @{HOME}/.{firefox,mozilla}/plugins/** rm,
usr.bin.firefox:  owner @{HOME}/.{firefox,mozilla}/**/plugins/** rm,
usr.bin.firefox:  owner @{HOME}/.gnome2/firefox*-bin-* rw,
usr.bin.firefox:  owner @{HOME}/.cache/mozilla/{,firefox/} rw,
usr.bin.firefox:  owner @{HOME}/.cache/mozilla/firefox/** rw,
usr.bin.firefox:  owner @{HOME}/.cache/mozilla/firefox/**/*.sqlite k,
usr.bin.firefox:  owner @{HOME}/.mozilla/**/extensions/** mixr,

I do not see anything that would allow firefox to write anywhere in HOME. Any ideas?

Technical info:

$ uname -r
3.16.0-38-generic

Linux Mint 17.2 with XFCE

Other notes:

On my laptop, I have Debian Jessie with Gnome and AppArmor seems to behave better. Although I did not use the default firefox profile on that machine, I made one that looks pretty similar for firefox-esr/iceweasel. It works as expected.

Profile: http://pastebin.com/XFJgWJbn

  • I never used apparmor but I would suggest you to add the full /etc/apparmor.d/usr.bin.firefox file to your question, that way someone can test it. Also, just out of a random guess what does /sys/module/apparmor/parameters/enabled contain? (it should contain a Y) – grochmal Sep 5 '16 at 22:35
  • @grochmal Yes, it says Y. I'll update the post with a link to the profile. – Paul Nordin Sep 5 '16 at 22:48
2

So my first track down of includes did not cover everything ... I did not realize that some of the abstractions also had their own includes. I opened up abstractions/ubuntu-browsers.d/firefox and I noticed a suspect include abstractions/ubuntu-browsers.d/user-files. I opened up user-files and it contains a problematic line owner @{HOME}/** w. The entire file was too permissive for my taste so I removed the user-files include from the firefox abstraction altogether, reloaded, and voila!

Making everything in HOME writable in an abstraction (especially, one used by other abstractions) sounds like a horrible idea. I can only conclude that the default Firefox profile provided by Ubuntu is pretty useless, providing only a false sense of security.

The moral of the story? Test your AppArmor profiles thoroughly, be careful with abstractions, and write your own profiles or really really check over any profile provided by a third party.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.