Firefox flash enable Profile include

Hi,

Thanks for working on this profile!

On Fri, Sep 28, 2007 at 10:27:00PM -0000, Philippe Baumgart wrote:
> rw for /home/*/** (ie ability to save file inside your home directory)

This doesn't seem like a good idea. Perhaps just to Desktop/ ? You
wouldn't want firefox stealing your ssh private keys, for example.

> rw for /tmp/** (ie abilty to open temp file within firefox like PDF files ect ...)

Please use the abstractions/user-tmp file.

> /dev/snd/controlC0 rw,
> /dev/snd/pcmC0D0p rw,
> /dev/snd/timer r,

Please use the abstractions/audio file.

> /etc/gnome-vfs-2.0/modules/ r,
> ...

Please use the abstractions/gnome (which includes user-tmp, X and fonts)

> /home/ r,
> /home/*/ r,

These two shouldn't be needed.

> /home/*/** krw,

For /home/*, please use @{HOME} global variable. And I'd recommend not
doing more than:

  @{HOME}/Desktop/** krwl,
  @{HOME}/.mozilla/firefox/** krwl,

> /proc/ r,
> /proc/*/cmdline r,
> /proc/*/maps r,
> /proc/*/mounts r,
> /proc/*/stat r,
> /proc/*/status r,
> /proc/meminfo r,
> /proc/stat r,
> /proc/sys/kernel/pid_max r,
> /proc/tty/drivers r,
> /proc/uptime r,
> /proc/version r,

These should already be in various abstractions (but please use @{PROC}
if you need to).

> /usr/share/pycentral/apturl/site-packages/AptUrl/Parser.py r,

There is a python abstraction too.

Good start!

Thanks a lot for your comment Kees, here is the new version that allows rw only to Desktop and .mozilla/firefox
But I'm afraid the gnome abstraction seems to allow way too much things

# Last Modified: Wed Sep 26 05:22:46 2007
#include <tunables/global>
/usr/lib/firefox/firefox {
  #include <abstractions/base>
  #include <abstractions/gnome>

  capability sys_ptrace,

  / r,
  /bin/dash ixr,
  /bin/grep ixr,
  /bin/ls ixr,
  /bin/ps ixr,
  /bin/pwd ixr,
  /bin/sed ixr,
  /bin/which ixr,
  /etc/firefox/pref/ r,
  /etc/firefox/pref/firefox.js r,
  /etc/gai.conf r,
  /etc/gnome/defaults.list r,
  /etc/mailcap r,
  /etc/mime.types r,
  /etc/mtab r,
  /etc/python2.5/site.py r,
  @{HOME}/Desktop/** krw,
  @{HOME}/.mozilla/firefox/** krw,
  /usr/bin/basename ixr,
  /usr/bin/dirname ixr,
  /usr/bin/eog ixr,
  /usr/bin/evince ixr,
  /usr/bin/gedit ixr,
  /usr/bin/gksu ixr,
  /usr/bin/python2.5 ixr,
  /usr/bin/sudo ixr,
  /usr/bin/totem ixr,
  /usr/lib/** mr,
  /usr/lib/firefox/firefox ixr,
  /usr/lib/firefox/firefox-bin ixr,
  /usr/lib/firefox/run-mozilla.sh ixr,
  /usr/lib/gamin/gam_server ixr,
  /usr/local/lib/python2.5/site-packages/ r,
  /usr/local/share/applications/ r,
  /usr/local/share/applications/mimeinfo.cache r,
  /usr/local/share/icons/ r,
  /usr/sbin/synaptic ixr,
  /usr/share/applications/ r,
  /usr/share/applications/* r,
  /usr/share/firefox/** r,
  /usr/share/myspell/*/ r,
  /usr/share/myspell/dicts/* r,
  /usr/share/synaptic/glade/* r,
  /usr/share/ubuntu-artwork/* r,
  /usr/share/ubuntu-artwork/home/* r,
  /usr/share/ubuntu-artwork/img/* r,
}

Forget my last profile it's not working I forgot to restart the deamon while testing it ... Im working on it and I hope to post a better version soon !

Great! When you do, please use the "Attach" function rather than
pasting it into the comment. This makes it easy for people to download
and test. Thanks!

Here is the new version , please test it and let me know if this works well for you too.

I had to add these entries:

/etc/orbitrc r,
/tmp/krb5cc_* k,
@{HOME}/.local/share/applications/** r,
/usr/share/locale-langpack/** r,

Thanks for your contrib, by the way there is one thing to do to make this profile useful to most people it's enabling java plugin usage. I hope to find some time to work on it in a week or two but if someone is already working on it please post it here so that we can check if we can merge it with this profile.

Personally I would set firefox to download files to a separate directory and not give it access to the entire dekstop, like so:

@{HOME}/Desktop/downloads/** krw,

However, I guess you want the profile to match firefox' default configuration if it is to go into the repository.

You got the point, I'm not a big fan of this default location either
but this is not my choice to make ...
Any body checked the java plugin compatibility with this profile ?

On 30 oct. 07, at 17:05, J.Ring wrote:

> Personally I would set firefox to download files to a separate
> directory
> and not give it access to the entire dekstop, like so:
>
> @{HOME}/Desktop/downloads/** krw,
>
> However, I guess you want the profile to match firefox' default
> configuration if it is to go into the repository.
>
> --
> Firefox flash enable Profile include
> https://bugs.launchpad.net/bugs/146507
> You received this bug notification because you are a direct subscriber
> of the bug.

firefox-3.5 in Ubuntu 9.10 now has an opt-in profile.