Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Adapt AppArmor profile for Tor browser 13.0 #709

Merged
merged 5 commits into from
Oct 4, 2023
Merged

Adapt AppArmor profile for Tor browser 13.0 #709

merged 5 commits into from
Oct 4, 2023

Commits on Sep 28, 2023

  1. AppArmor: allow executing glxtest 

    This "Firefox OpenGL probe utility" was added in Tor Browser 13.
    @anonym
    anonym committed Sep 28, 2023
    Configuration menu
    Copy the full SHA
    629493a View commit details
    Browse the repository at this point in the history

  2. AppArmor: allow reading/writing to /proc/PID/oom_score_adj 

    Firefox adjusts the OOM scores of its processes so that if they are
reaped they are killed in a sane order, e.g. the parent process last.

Source: hal/linux/LinuxProcessPriority.cpp
    @anonym
    anonym committed Sep 28, 2023
    Configuration menu
    Copy the full SHA
    41f2058 View commit details
    Browse the repository at this point in the history

  3. AppArmor: give read access to proc info about which command the brows… 

    …er's threads use
    @anonym
    anonym committed Sep 28, 2023
    Configuration menu
    Copy the full SHA
    b257da0 View commit details
    Browse the repository at this point in the history

  4. AppArmor: silence denial of sys_ptrace capability 

    We already allow ptrace for its relevant subprocesses via ptrace
rules, and I'm unsure if the full capability is really needed. I see
lots of other profiles which have ptrace rules without the capability
so I guess not. And I wonder if allowing the capability allows ptrace
for arbitrary processes, which would be really bad.

So let's assume it's not needed and we'll see what happens.
    @anonym
    anonym committed Sep 28, 2023
    Configuration menu
    Copy the full SHA
    29e1fe4 View commit details
    Browse the repository at this point in the history

  5. AppArmor: silence denial to read /sys/class/input/ 

    It is unclear to me what this is about.
    @anonym
    anonym committed Sep 28, 2023
    Configuration menu
    Copy the full SHA
    b80e007 View commit details
    Browse the repository at this point in the history