FYI AppArmor Firefox profile

# Last Modified: Tue Sep 13 10:15:00 2016
# vim:syntax=apparmor
#include <tunables/global>

/usr/lib64/firefox/firefox.sh {
  #include <abstractions/X>
  #include <abstractions/apache2-common>
  #include <abstractions/audio>
  #include <abstractions/base>
  #include <abstractions/bash>
  #include <abstractions/freedesktop.org>
  #include <abstractions/gnome>
  #include <abstractions/kde>
  #include <abstractions/nameservice>
  #include <abstractions/nvidia>
  #include <abstractions/p11-kit>
  #include <abstractions/ssl_certs>
  #include <abstractions/ssl_keys>
 
  capability sys_ptrace,

  /**/.directory r,
  /bin/bash ix,
  /bin/dbus rix,
  /bin/ps rix,
  # this is not very secure and may need to be overworked
  # both should have their own profile, one day...
  /usr/bin/lpr Ux,
  /usr/bin/ffmpeg Ux,
  #
  # /usr/bin/pulseaudio Ux, dont remember why I commented this out...
  /usr/bin/dbus* rix,
  /usr/lib64/kde4/libexec/lnusertemp rix,
  /usr/bin/kdeinit4 rix,
  /etc/fstab r,
  /etc/cups/ r,
  /etc/cups/** r,
  /home/*/.cups/ r,
  /home/*/.cups/** r,
  /dev/nvidia* rw,
  /dev/shm/ r,
  /dev/shm/pulse-shm-* rw,
  /dev/tty* rw,
  /dev/v4l/ r,
  /dev/v4l/** rw,
  /dev/video* rw,
  /etc/exports r,
  /etc/kde*/share/config/oxygenrc r,
  /etc/alsa-pulse.conf r,
  /etc/asound-pulse.conf r,
  /etc/asound.conf r,
  /etc/fonts/** r,
  /etc/gtk-2.0/gtkrc r,
  /etc/kde*/share/config/kdebugrc r,
  /etc/kde*/share/config/kdeglobals r,
  /etc/kde*/share/config/kioslaverc r,
  /etc/kde*rc r,
  /etc/ld.so.preload r,
  /etc/machine-id r,
  /etc/magic r,
  /etc/mailcap r,
  /etc/mime.types r,
  /etc/pulse/client.conf r,
  /etc/rcc.xml r,
  /etc/udev/udev.conf r,
  /etc/vdpau_wrapper.cfg r,
  /etc/modprobe.d/** r,
  /etc/freshwrapper.conf r,
  deny /home/*/.thunderbird r,
  owner /home/*/.xauth* r,
  /home/*/Desktop/ r,
  /home/*/Desktop/** r,
  # for video download helper addon
  /home/*/dwhelper/ rw,
  /home/*/.kde*/share/config/knfsshare rk,
  /home/*/dwhelper/** rw,
  /home/*/.config/kde.org/libphonon.conf rk,
  owner /home/*/.kde4/ r,
  # some kind of shotgun approach, may need overworked          
  owner /home/*/.kde4/** rwk,
  /home/*/.kde*/share/config/oxygenrc r,
  /home/*/ r,
  /home/*/.Xauthority r,
  # needed for Flash
  owner  /home/*/.adobe/** rwk,
  /home/*/.local/share/gvfs*/* r,
  /home/*/.cache/fontconfig/** r,
 owner  /home/*/.cache/mozilla/ r,
 owner  /home/*/.cache/mozilla/** rwk,
  /home/*/.config/**/*gtk* r,
  /home/*/.config/gtk* r,
  /home/*/.config/fontconfig/fonts.conf r,
  /home/*/.config/pulse/cookie rk,
  /home/*/.config/qtcurve/gtk-icons r,
  /home/*/.config/qtcurve/gtk-icons* w,
  /home/*/.config/qtcurve/stylerc r,
  /home/*/.config/freshwrapper*/ r,
  /home/*/.config/freshwrapper*/** rw,
  /home/*/.fonts/ r,
  /home/*/.gstreamer*/* rw,
  /home/*/.cache/gstream*/ rw,
  /home/*/.cache/gstream*/** rwk,
  /home/*/.gnom*/ rw,
  # one more shotgun approach, since i dont use gnome, an attacker wouldnt see
  # much there anyway
  /home/*/.gnom*/** rwkl,
  /home/*/.gtkrc-2.0 r,
  /home/*/.icons/** r,
  /home/*/.kde*/socket*/ rw,
  /home/*/.kde*/socket*/** rwk,
  /home/*/.kde*/share/apps/RecentDocuments/* r,
  /home/*/.kde*/share/apps/RecentDocuments/** r,
  /home/*/.kde*/share/config/servicetype_profilerc r,
  /home/*/.kde*/share/apps/RecentDocuments/* rw,
  /home/*/.kde*/share/config/ktimezonedrc r,
  /home/*/.kde*/share/config/kbookmarkrc r,
  /home/*/.kde*/share/apps/kfileplaces/bookmarks.xml r,
  /home/*/.kde*/share/apps/RecentDocuments/*.pdf.desktop.lock w,
  /home/*/.kde*/share/config/kio_thumbnailrc r,
  /home/*/.kde*/share/config/ r,
  /home/*/.kde*/share/config** r,
  /home/*/.kde*/share/config/kdebugrc r,
  /home/*/.kde*/share/config/kdeglobal* rwk,
  /home/*/.kde*/share/config/kioslaverc r,
  /home/*/.kde*/share/config/kmozillahelperrc* rwk,
  /home/*/.kde*/share/config/kwinrc r,
  /home/*/.local/share/user-places* rw,
  /home/*/.local/share/gvfs-metadata/root r,
  /home/*/.local/share/icons/** r,
  /home/*/.local/share/mime/mime.cache r,
  # again old Flash or macromedia stuff
  /home/*/.macromedia/** rwk,
  /home/*/.mozilla/extensions/** r,
owner  /home/*/.mozilla/firefox/ r,
owner  /home/*/.mozilla/firefox/** rwk,
owner  "/home/*/.mozilla/firefox/Crash Reports/*" rw,
owner  /home/*/.mozilla/firefox/profiles.ini rw,
  /home/*/.mozilla/plugins/ r,
  /home/*/.nv/** rwk,
owner  /home/*/.thumbnails/** rw,
  /home/*/download*/ rw,
  /home/*/download*/** rw,
  /home/*/Download*/ rw,
  /home/*/Download*/** rw,
owner  /home/*/tmp/ rw,
owner  /home/*/tmp/** rw,
  /opt/kde3/share/fonts/ r,
  /opt/lib/lib*so* mr,
  /proc/ r,
  /proc/@{pid}/cmdline r,
  /proc/*/fd/ r,
  /proc/*/maps r,
  /proc/*/mountinfo r,
  /proc/*/stat r,
  /proc/*/status r,
  /proc/*/task/*/stat r,
  /proc/*/auxv r,
  /proc/driver/nvidia/params r,
  /proc/filesystems r,
  /proc/meminfo r,
  /proc/sys/kernel/modprobe r,
  /proc/sys/kernel/random/ r,
  /proc/sys/kernel/random/* r,
  /proc/sys/kernel/pid_max r,
  /proc/uptime r,
  /proc/modules r,
  /proc/tty/drivers r,
  /run/udev/data/* r,
  /run/udev/queue.bin r,
  # not sure if this hole should be closed
  /sbin/modprobe rix,
  /sys/devices/**/uevent r,
  /sys/devices/system/cpu/ r,
  /sys/devices/system/cpu/** r,
  /sys/module/drm/ r,
  /sys/module/drm/** r,
  /sys/module/nvidia/ r,
  /sys/module/nvidia/** r,
  /sys/bus/ r,
  /sys/bus/** r,
  /sys/bus/cpu/ r,
  /sys/bus/cpu/** r,
  /sys/class/ r,
  /sys/class/** r,
  /run/user/ r,
  /run/user/** r,
  owner /run/user/** rwlk,

  owner /tmp/** rwlk,
  /tmp/** m,
  /usr/ r,
  /usr/** r,
  /usr/bin/basename rix,
  /usr/bin/net rix,
  /usr/bin/testparm rix,
  /usr/bin/expr rix,
  /usr/bin/file rix,
  /usr/bin/grep rix,
  /usr/bin/kcmshell4 rix,
  /usr/bin/kde*-config rix,
  /usr/bin/nvidia-modprobe rix,
  /usr/bin/which rix,
  /usr/lib/mozilla/kmozillahelper rix,
  /usr/lib64/firefox/firefox rix,
  /usr/lib64/firefox/firefox-bin rix,
  /usr/lib64/firefox/plugin-container rix,
  /usr/lib64/firefox/crashreporter rix,
  /usr/lib64/firefox/webapprt-stub rix,
  /usr/lib64/gstreamer*/gst-* rix,
  /usr/lib/gstream*/gst* rix,
  /usr/lib64/rcc/rccexternal rix,
  # VLC can act as multimedia plugin
  /usr/lib64/vlc/plugins/ r,
  /usr/lib64/vlc/plugins/** r,
  /usr/lib64/vlc/plugins/plugins.dat* rwk,
  /usr/lib{,32,64}/** mr,
  /usr/share/cantarell-fonts/*/*cantarell.conf r,
  /usr/share/doc/** r,
  /usr/share/fontconfig/**/*.conf r,
  /usr/share/fonts-config/**/*.conf r,
  /usr/share/fonts/ r,
  /usr/share/fonts/** r,
  /usr/share/ghostscript/fonts/ r,
  /usr/share/icons/ r,
  /usr/share/icons/** r,
  /usr/share/icu/**/*.dat r,
  /usr/share/kde*/config/kdebug.areas r,
  /usr/share/kde*/config/kdebugrc r,
  /usr/share/locale-bundle/**/*.mo r,
  /usr/share/mime/ r,
  /usr/share/mime/mime.cache r,
  /usr/share/misc/magic.mgc r,
  /usr/share/mozilla/** r,
  /usr/share/nvidia/*rc r,
  /usr/share/pixmaps/** r,
  /usr/share/sounds/** r,
  /usr/share/themes/**/gtkrc r,
  /usr/share/themes/**/kdeglobals r,
  /var/cache/fontconfig/*.cache* r,
  /var/cache/gio-2.0/gnome-defaults.list r,
  /var/cache/libx11/compose/* r,
  /var/lib/samba/ r,
  /var/lib/samba/** r,

}