2

I would like to run Firefox with aa-enforce(d) apparmor profile. This works fine, except I have a plugin that need access to the keyring via dbus. When the plugin (https://github.com/swick/moz-gnome-keyring-integration) tries to access the keyring, I get this message in the logs:

[ apparmor="DENIED" operation="dbus_method_call" bus="session" path="/org/freedesktop/secrets" interface="org.freedesktop.DBus.Properties" member="Get" mask="send" name="org.freedesktop.secrets" pid=20004 profile="/usr/lib/firefox/firefox{,*[^s][^h]}" peer_pid=2810 peer_profile="unconfined"]

So I am trying to grant dbus access to my firefox profile, without altering the base profile provided by apparmor-profies package, so I modified the file in /etc/apparamor.d/local/usr.bin.firefox.

Here is what I tried:

# Site-specific additions and overrides for usr.bin.firefox.
# For more details, please see /etc/apparmor.d/local/README.
# Allow gnome keyring integration to work
/usr/lib/firefox/firefox{,*[^s][^h]} {
  dbus (send,receive)
    bus=session
    interface=org.freedesktop.DBus.Properties
    path=/org/freedesktop/secrets,
}

but, then, on aa-enforce usr.bin.firefox, I get this error:

apparmor.common.AppArmorException: 'local/usr.bin.firefox profile in local/usr.bin.firefox contains syntax errors in line: 4.'

This is the first time I try to create or modify an apparmor profile, and I'm stuck here... What should the syntax be?

EDIT: using apparmor_parser, I got another bit of information:

AppArmor parser error for /etc/apparmor.d/usr.bin.firefox in /etc/apparmor.d/local/usr.bin.firefox at line 4: syntax error, unexpected TOK_OPEN, expecting TOK_MODE

So, unexpected TOK_OPEN, expecting TOK_MODE... no idea what it mean yet.

EDIT2: I tried the same stanza directly within the /etc/apparmor.d/usr.bin.firefox profile, and it works. So the problem has to do with using the local customization...

1

The problem arises from the opening brackets ( { and } ). The #include statement is already inside the main profile's declaration, so the brackets are not required.

# Site-specific additions and overrides for usr.bin.firefox.
# For more details, please see /etc/apparmor.d/local/README.
# Allow gnome keyring integration to work

dbus (send,receive)
  bus=session
  interface=org.freedesktop.DBus.Properties
  path=/org/freedesktop/secrets,
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.