Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have a pretty standard default install of 11.10 (Unity 3D).

I'm trying to understand a bit about AppArmor. sudo aa-status shows me that the available Firefox profile isn't being enforced (since it isn't listed).

Am I right in using sudo aa-enforce /etc/apparmor.d/usr.bin.firefox and then rebooting to start the enforcement (immunization)?

Is it correct that the Firefox profile isn't active by default since the current version number (now 7.0.1) is part of the profile? /usr/lib/firefox-7.0.1/ appears several times. In other words, users will have to be aware of this and bump the version number (correctly) each time it changes? Is that the only reason the profile isn't enforced by default?

Or is there something else I need to do before enforcing the default Firefox profile? Will just editing /etc/apparmor.d/usr.bin.firefox with each change in version number be sufficient?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

In theory you don't have to do anything when the firefox version changes as the AA profile is updated too.

"Activating" the FF AppArmor profile via sudo aa-enforce /etc/apparmor.d/usr.bin.firefox will enforce the policies right away, no need to reboot.

share|improve this answer
    
But I'd appreciate knowing why the Fx profile isn't enabled by default. wiki.ubuntu.com/SecurityTeam/KnowledgeBase/AppArmorProfiles mentions that it "Will be disabled by default and be opt-in for advanced users" but reason is given. –  user25656 Nov 7 '11 at 11:14
3  
You mean no reason is given? Then look at wiki.ubuntu.com/SecurityTeam/Specifications/Karmic/… –  arrange Nov 7 '11 at 11:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.