From 0284862610a0fad37df4a21ed137d087b2eff1af Mon Sep 17 00:00:00 2001
From: Reiner Herrmann <reiner@reiner-h.de>
Date: Sun, 25 Oct 2026 23:10:55 +0100
Subject: update firefox profile

---
 usr.lib.firefox.firefox | 68 ++++++++++++++++++++++++++++++++++++-------------
 1 file changed, 50 insertions(+), 18 deletions(-)

diff --git a/usr.lib.firefox.firefox b/usr.lib.firefox.firefox
index 086ec49..0d161a3 100644
--- a/usr.lib.firefox.firefox
+++ b/usr.lib.firefox.firefox
@@ -1,27 +1,40 @@
 #include <tunables/global>
 
-/usr/lib/firefox/firefox {
-  #include <abstractions/X>
-  #include <abstractions/audio>
-  #include <abstractions/base>
-  #include <abstractions/bash>
-  #include <abstractions/dconf>
-  #include <abstractions/gnome>
-  #include <abstractions/consoles>
-  #include <abstractions/fonts>
-  #include <abstractions/nameservice>
-  #include <abstractions/freedesktop.org>
-  #include <abstractions/user-tmp>
+profile /usr/lib/firefox/firefox {
+  include <abstractions/X>
+  include <abstractions/audio>
+  include <abstractions/base>
+  include <abstractions/bash>
+  include <abstractions/dconf>
+  include <abstractions/gnome>
+  include <abstractions/consoles>
+  include <abstractions/fonts>
+  include <abstractions/nameservice-strict>
+  include <abstractions/freedesktop.org>
+  include <abstractions/user-tmp>
+  include <abstractions/mesa>
 
+  userns,
+  network inet,
+  network inet6,
+  network netlink,
+
+  / r,
   /bin/dash ix,
   /bin/readlink rix,
   /bin/which rix,
   /usr/bin/dirname ix,
 
-  /etc/firefox/ r,
-  /etc/firefox/** r,
+  /usr/lib/firefox/vaapitest ix,
+  /usr/lib/firefox/glxtest ix,
+  /usr/lib/firefox/gfxtest ix,
+  /usr/share/glvnd/** r,
+  /usr/share/libdrm/** r,
+
+  /etc/firefox/{,**} r,
   /etc/mime.types r,
   /etc/mailcap r,
+  /etc/fstab r,
 
   /usr/share/xulrunner-*/** r,
   /usr/share/firefox/** r,
@@ -34,19 +47,38 @@
 
   /usr/share/glib-2.0/schemas/gschemas.compiled r,
 
-  /sys/devices/system/cpu/present r,
-  /sys/devices/pci[0-9]*/**/{device,subsystem_device,subsystem_vendor,uevent,vendor} r,
-  owner @{PROC}/[0-9]*/{mountinfo,smaps,stat,statm} r,
+  /sys/devices/** r,
+  /sys/bus/{,**} r,
+  /sys/class/ r,
+  /sys/class/hidraw/ r,
+  /sys/fs/cgroup/**/cpu.max r,
+  /dev/hidraw* rw,
+  owner @{PROC}/@{pid}/{fd/,cmdline,mountinfo,smaps,stat,statm,cgroup} r,
+  owner @{PROC}/@{pid}/task/ r,
+  owner @{PROC}/@{pid}/task/[0-9]*/{comm,stat} r,
+  @{PROC}/pressure/memory r,
   /dev/ r,
   /dev/dri/ r,
+  owner @{PROC}/@{pid}/oom_score_adj w,
   owner /{dev,run}/shm/org.chromium.* mrw,
   owner /{dev,run}/shm/org.mozilla.ipc.* mrw,
 
+  owner /run/user/*/dconf/user rw,
   owner @{HOME}/.mozilla/ w,
   owner @{HOME}/.mozilla/firefox/ w,
   owner @{HOME}/.mozilla/firefox/** rwk,
+  owner @{HOME}/.config/mozilla/ w,
+  owner @{HOME}/.config/mozilla/firefox/ w,
+  owner @{HOME}/.config/mozilla/firefox/** rwk,
   owner @{HOME}/.cache/mozilla/** rwk,
   owner @{HOME}/.cache/dconf/user rw,
   owner @{HOME}/.config/mimeapps.list.* w,
-  owner @{HOME}/Downloads/** rw,
+  owner @{HOME}/Downloads/{,**} rw,
+  owner @{HOME}/config/** r,
+
+  # bwrap / glycin-loaders
+  /usr/bin/bwrap rix,
+  /usr/libexec/glycin-loaders/2+/* rix,
+  /usr/share/glycin-loaders/2+/conf.d/{,**} r,
+  @{PROC}/sys/kernel/overflow[gu]id r,
 }
-- 
cgit v1.2.3