I would like to run Firefox with aa-enforce(d) apparmor profile. This works fine, except I have a plugin that need access to the keyring via dbus. When the plugin (https://github.com/swick/moz-gnome-keyring-integration) tries to access the keyring, I get this message in the logs:
[ apparmor="DENIED" operation="dbus_method_call" bus="session" path="/org/freedesktop/secrets" interface="org.freedesktop.DBus.Properties" member="Get" mask="send" name="org.freedesktop.secrets" pid=20004 profile="/usr/lib/firefox/firefox{,*[^s][^h]}" peer_pid=2810 peer_profile="unconfined"]
So I am trying to grant dbus access to my firefox profile, without altering the base profile provided by apparmor-profies package, so I modified the file in /etc/apparamor.d/local/usr.bin.firefox.
Here is what I tried:
# Site-specific additions and overrides for usr.bin.firefox.
# For more details, please see /etc/apparmor.d/local/README.
# Allow gnome keyring integration to work
/usr/lib/firefox/firefox{,*[^s][^h]} {
dbus (send,receive)
bus=session
interface=org.freedesktop.DBus.Properties
path=/org/freedesktop/secrets,
}
but, then, on aa-enforce usr.bin.firefox, I get this error:
apparmor.common.AppArmorException: 'local/usr.bin.firefox profile in local/usr.bin.firefox contains syntax errors in line: 4.'
This is the first time I try to create or modify an apparmor profile, and I'm stuck here... What should the syntax be?
EDIT: using apparmor_parser, I got another bit of information:
AppArmor parser error for /etc/apparmor.d/usr.bin.firefox in /etc/apparmor.d/local/usr.bin.firefox at line 4: syntax error, unexpected TOK_OPEN, expecting TOK_MODE
So, unexpected TOK_OPEN, expecting TOK_MODE... no idea what it mean yet.
EDIT2: I tried the same stanza directly within the /etc/apparmor.d/usr.bin.firefox profile, and it works. So the problem has to do with using the local customization...
