1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
|
#include <tunables/global>
profile /usr/lib/firefox/firefox {
include <abstractions/X>
include <abstractions/audio>
include <abstractions/base>
include <abstractions/bash>
include <abstractions/dconf>
include <abstractions/gnome>
include <abstractions/consoles>
include <abstractions/fonts>
include <abstractions/nameservice-strict>
include <abstractions/freedesktop.org>
include <abstractions/user-tmp>
include <abstractions/mesa>
userns,
network inet,
network inet6,
network netlink,
/ r,
/bin/dash ix,
/bin/readlink rix,
/bin/which rix,
/usr/bin/dirname ix,
/usr/lib/firefox/vaapitest ix,
/usr/lib/firefox/glxtest ix,
/usr/lib/firefox/gfxtest ix,
/usr/share/glvnd/** r,
/usr/share/libdrm/** r,
/etc/firefox/{,**} r,
/etc/mime.types r,
/etc/mailcap r,
/etc/fstab r,
/usr/share/xulrunner-*/** r,
/usr/share/firefox/** r,
/usr/share/mozilla/** r,
/usr/share/mime/ r,
/usr/share/doc/** r,
/usr/share/fontconfig/** r,
/usr/lib/firefox/firefox ix,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/sys/devices/** r,
/sys/bus/{,**} r,
/sys/class/ r,
/sys/class/hidraw/ r,
/sys/fs/cgroup/**/cpu.max r,
/dev/hidraw* rw,
owner @{PROC}/@{pid}/{fd/,cmdline,mountinfo,smaps,stat,statm,cgroup} r,
owner @{PROC}/@{pid}/task/ r,
owner @{PROC}/@{pid}/task/[0-9]*/{comm,stat} r,
@{PROC}/pressure/memory r,
/dev/ r,
/dev/dri/ r,
owner @{PROC}/@{pid}/oom_score_adj w,
owner /{dev,run}/shm/org.chromium.* mrw,
owner /{dev,run}/shm/org.mozilla.ipc.* mrw,
owner /run/user/*/dconf/user rw,
owner @{HOME}/.mozilla/ w,
owner @{HOME}/.mozilla/firefox/ w,
owner @{HOME}/.mozilla/firefox/** rwk,
owner @{HOME}/.config/mozilla/ w,
owner @{HOME}/.config/mozilla/firefox/ w,
owner @{HOME}/.config/mozilla/firefox/** rwk,
owner @{HOME}/.cache/mozilla/** rwk,
owner @{HOME}/.cache/dconf/user rw,
owner @{HOME}/.config/mimeapps.list.* w,
owner @{HOME}/Downloads/{,**} rw,
owner @{HOME}/config/** r,
# bwrap / glycin-loaders
/usr/bin/bwrap rix,
/usr/libexec/glycin-loaders/2+/* rix,
/usr/share/glycin-loaders/2+/conf.d/{,**} r,
@{PROC}/sys/kernel/overflow[gu]id r,
}
|
