I don't want programs to be able to read my whole home directory. For example, I'd like to have firefox's read ability restricted to:

owner @{HOME}/Downloads/ r, owner @{HOME}/Downloads/** rwk, owner @{HOME}/.mozilla/ r, owner @{HOME}/.mozilla/** rwk,

  • plus all the appropriate dirs in .cache, .config etc

Thing about is that apparmor gives my user's reading rights, meaning ff can read everything unless I say

deny @{HOME}/Documents/ rwk,

Documents will be available for firefox.

Is there no way of denying the reading rights to everything in the home dir with the exceptions being the files I list in the profile?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.