mjhjmtu

Is there a way to create an AppArmor profile for each Firefox profile, when running multiple profiles off a single installation of Firefox? Or more generally for any application supporting multiple profiles, Thunderbird, etc. Generally all the AppArmor profiles I find for these apps only contain the whole app, unless I missed something.

Usually you launch a Firefox or Thunderbird with a command line argument to specify a different profile. However I can find nothing in the AppArmor profile syntax to match against app arguments.

I know libvirt does this somehow by creating an AppArmor profile for each virtual machine, so there must be some way.

AppArmor works by executable. It can't figure out that Firefox has loaded a different profile and so it should use a different AppArmor profile.

AppArmor does support change rules, which allow an application to change which profile applies to it. The intended use case is precisely to allow an application to switch to a more restrictive profile once it's finished initializing and figured out what it needs to access in this particular instance. So if Firefox was AppArmor-aware, it would be possible to give it change_profile rule and have it apply the transition once it's figured out which profile to run as. As far as I know, this hasn't been done.

What you can do without programming is make multiple copies or hard links of the firefox-bin executable, and define different profiles for each of them (AppArmor is based on the path to the executable, so different hard links need not use the same profile, unlike SELinux which is based on inodes). This requires root and isn't so convenient, which is why the change profile feature was added to AppArmor.

I'm not sure, but as I understand, I think: no.

Apparmor could make distinction between different

• application


• file-system path


• user / group

For having different apparmor behaviour against different application profile, you have to create different users for each apparmor behaviour.

Like android do for sandboxing all apps under different ``user''.

Very easy, my friend. Create a hard-link called firefox-(putProfileNameHere):

cd /data/usr/lib/firefox/
sudo ln firefox /usr/bin/firefox-default
sudo ln firefox /usr/bin/firefox-1b58iygj
#etc etc etc

Create multiple App Armor profiles:

cd /etc/apparmor.d
cp usr.bin.firefox usr.bin.firefox-default
cp usr.bin.firefox usr.bin.firefox-1b58iygj
#etc etc etc

Modify each profile as you wish.

Create different .desktop files in /usr//share/applications (or use a Menu manager like Alacarte or KDE ??) to launch the custom binaries + relevant profile:

firefox-default 
firefox-1b58iygj --profile /home/<yourUserID>/.mozilla/firefox/1b58iygj
#etc etc etc

Have fun.