diff options
| -rw-r--r-- | usr.lib.firefox.firefox | 68 |
1 files changed, 50 insertions, 18 deletions
diff --git a/usr.lib.firefox.firefox b/usr.lib.firefox.firefox index 086ec49..0d161a3 100644 --- a/usr.lib.firefox.firefox +++ b/usr.lib.firefox.firefox @@ -1,27 +1,40 @@ #include <tunables/global> -/usr/lib/firefox/firefox { - #include <abstractions/X> - #include <abstractions/audio> - #include <abstractions/base> - #include <abstractions/bash> - #include <abstractions/dconf> - #include <abstractions/gnome> - #include <abstractions/consoles> - #include <abstractions/fonts> - #include <abstractions/nameservice> - #include <abstractions/freedesktop.org> - #include <abstractions/user-tmp> +profile /usr/lib/firefox/firefox { + include <abstractions/X> + include <abstractions/audio> + include <abstractions/base> + include <abstractions/bash> + include <abstractions/dconf> + include <abstractions/gnome> + include <abstractions/consoles> + include <abstractions/fonts> + include <abstractions/nameservice-strict> + include <abstractions/freedesktop.org> + include <abstractions/user-tmp> + include <abstractions/mesa> + userns, + network inet, + network inet6, + network netlink, + + / r, /bin/dash ix, /bin/readlink rix, /bin/which rix, /usr/bin/dirname ix, - /etc/firefox/ r, - /etc/firefox/** r, + /usr/lib/firefox/vaapitest ix, + /usr/lib/firefox/glxtest ix, + /usr/lib/firefox/gfxtest ix, + /usr/share/glvnd/** r, + /usr/share/libdrm/** r, + + /etc/firefox/{,**} r, /etc/mime.types r, /etc/mailcap r, + /etc/fstab r, /usr/share/xulrunner-*/** r, /usr/share/firefox/** r, @@ -34,19 +47,38 @@ /usr/share/glib-2.0/schemas/gschemas.compiled r, - /sys/devices/system/cpu/present r, - /sys/devices/pci[0-9]*/**/{device,subsystem_device,subsystem_vendor,uevent,vendor} r, - owner @{PROC}/[0-9]*/{mountinfo,smaps,stat,statm} r, + /sys/devices/** r, + /sys/bus/{,**} r, + /sys/class/ r, + /sys/class/hidraw/ r, + /sys/fs/cgroup/**/cpu.max r, + /dev/hidraw* rw, + owner @{PROC}/@{pid}/{fd/,cmdline,mountinfo,smaps,stat,statm,cgroup} r, + owner @{PROC}/@{pid}/task/ r, + owner @{PROC}/@{pid}/task/[0-9]*/{comm,stat} r, + @{PROC}/pressure/memory r, /dev/ r, /dev/dri/ r, + owner @{PROC}/@{pid}/oom_score_adj w, owner /{dev,run}/shm/org.chromium.* mrw, owner /{dev,run}/shm/org.mozilla.ipc.* mrw, + owner /run/user/*/dconf/user rw, owner @{HOME}/.mozilla/ w, owner @{HOME}/.mozilla/firefox/ w, owner @{HOME}/.mozilla/firefox/** rwk, + owner @{HOME}/.config/mozilla/ w, + owner @{HOME}/.config/mozilla/firefox/ w, + owner @{HOME}/.config/mozilla/firefox/** rwk, owner @{HOME}/.cache/mozilla/** rwk, owner @{HOME}/.cache/dconf/user rw, owner @{HOME}/.config/mimeapps.list.* w, - owner @{HOME}/Downloads/** rw, + owner @{HOME}/Downloads/{,**} rw, + owner @{HOME}/config/** r, + + # bwrap / glycin-loaders + /usr/bin/bwrap rix, + /usr/libexec/glycin-loaders/2+/* rix, + /usr/share/glycin-loaders/2+/conf.d/{,**} r, + @{PROC}/sys/kernel/overflow[gu]id r, } |