Skip to content

mozilla #1212

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
etbe wants to merge 3 commits into
base: main
Choose a base branch
from
Open

mozilla #1212

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b4efd25
Added some small access needed by mozilla
etbe Aug 21, 2026
c4db0ee
Comment out a line for an interface from another PR
etbe Aug 21, 2026
a0d3adc
Added gnome_mmap_read_xdg_config_files back now that the other patch …
etbe Aug 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 27 additions & 1 deletion policy/modules/apps/mozilla.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,13 +75,15 @@ xdg_cache_content(mozilla_xdg_cache_t)

allow mozilla_t self:capability { setgid setuid sys_nice };
allow mozilla_t self:cap_userns { sys_admin sys_chroot sys_ptrace };
allow mozilla_t self:process { getsched setcap setrlimit setsched sigkill signal };
allow mozilla_t self:process { getsched setcap getcap ptrace setrlimit setsched sigkill signal };
allow mozilla_t self:user_namespace create;
allow mozilla_t self:fifo_file rw_fifo_file_perms;
allow mozilla_t self:shm create_shm_perms;
allow mozilla_t self:sem create_sem_perms;
allow mozilla_t self:socket create_socket_perms;
allow mozilla_t self:unix_stream_socket { accept listen };
allow mozilla_t self:netlink_route_socket nlmsg_write;
allow mozilla_t self:netlink_kobject_uevent_socket { create getattr getopt setopt };
Comment on lines +78 to +86

@pebenito pebenito Aug 21, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you clarify what the ptrace and netlink sockets are used for?


allow mozilla_t mozilla_plugin_t:unix_stream_socket rw_socket_perms;
allow mozilla_t mozilla_plugin_t:fd use;
Expand All @@ -106,6 +108,7 @@ manage_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
manage_lnk_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
manage_fifo_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
manage_sock_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
userdom_user_runtime_filetrans(mozilla_t, mozilla_tmpfs_t, sock_file)
fs_tmpfs_filetrans(mozilla_t, mozilla_tmpfs_t, { file lnk_file sock_file fifo_file })
allow mozilla_t mozilla_plugin_tmpfs_t:file map;

Expand Down Expand Up @@ -174,11 +177,13 @@ files_map_usr_files(mozilla_t)
files_read_usr_files(mozilla_t)
files_watch_usr_dirs(mozilla_t)
files_read_var_files(mozilla_t)
files_map_var_lib_files(mozilla_t)
files_read_var_lib_files(mozilla_t)
files_read_var_symlinks(mozilla_t)
files_dontaudit_getattr_boot_dirs(mozilla_t)

fs_getattr_all_fs(mozilla_t)
fs_getattr_nsfs_files(mozilla_t)
fs_search_auto_mountpoints(mozilla_t)
fs_list_inotifyfs(mozilla_t)
fs_rw_tmpfs_files(mozilla_t)
Expand All @@ -187,6 +192,8 @@ term_dontaudit_getattr_pty_dirs(mozilla_t)

auth_use_nsswitch(mozilla_t)

libs_exec_lib_files(mozilla_t)

logging_send_syslog_msg(mozilla_t)

miscfiles_read_fonts(mozilla_t)
Expand All @@ -212,7 +219,12 @@ mozilla_run_plugin_config(mozilla_t, mozilla_roles)
xdg_read_config_files(mozilla_t)
xdg_read_data_files(mozilla_t)
xdg_manage_downloads(mozilla_t)
xdg_watch_cache_dirs(mozilla_t)
xdg_watch_config_dirs(mozilla_t)
xdg_watch_data_dirs(mozilla_t)

xserver_manage_mesa_shader_cache(mozilla_t)
xserver_read_xkb_libs(mozilla_t)
xserver_rw_mesa_shader_cache(mozilla_t)
xserver_user_x_domain_template(mozilla, mozilla_t, mozilla_tmpfs_t)
xserver_dontaudit_read_xdm_tmp_files(mozilla_t)
Expand Down Expand Up @@ -268,6 +280,10 @@ optional_policy(`
cups_stream_connect(mozilla_t)
')

optional_policy(`
chromium_domtrans(mozilla_t)
')

optional_policy(`
dbus_all_session_bus_client(mozilla_t)
dbus_connect_all_session_bus(mozilla_t)
Expand All @@ -290,6 +306,10 @@ optional_policy(`
ntp_dbus_chat(mozilla_t)
')

optional_policy(`
rtkit_daemon_dbus_chat(mozilla_t)
')

optional_policy(`
systemd_dbus_chat_logind(mozilla_t)
')
Expand All @@ -308,6 +328,8 @@ optional_policy(`
gnome_home_filetrans_gnome_home(mozilla_t, dir, ".gnome")
gnome_home_filetrans_gnome_home(mozilla_t, dir, ".gnome2")
gnome_home_filetrans_gnome_home(mozilla_t, dir, ".gnome2_private")
gnome_mmap_read_xdg_config_files(mozilla_t)
gnome_watch_xdg_config_dirs(mozilla_t)
')

optional_policy(`
Expand Down Expand Up @@ -340,6 +362,10 @@ optional_policy(`
pulseaudio_run(mozilla_t, mozilla_roles)
')

optional_policy(`
rtkit_scheduled(mozilla_t)
')

optional_policy(`
thunderbird_domtrans(mozilla_t)
')
Expand Down
Loading