Merge pull request #469 from rogers0/PR/apparmor_meek

AppArmor: Support pluggable transports especially meek
torproject · Aug 18, 2020 · 0d2f14c · 0d2f14c
2 parents 6c9abd2 + 50e62ce
commit 0d2f14c
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/apparmor/torbrowser.Tor.tor b/apparmor/torbrowser.Tor.tor
@@ -24,13 +24,17 @@ profile torbrowser_tor @{torbrowser_tor_executable} {
   # Support some of the included pluggable transports
   owner @{torbrowser_home_dir}/TorBrowser/Tor/PluggableTransports/** rix,
   @{PROC}/sys/net/core/somaxconn r,
+  #include <abstractions/ssl_certs>
 
   # Silence file_inherit logs
   deny @{torbrowser_home_dir}/{browser/,}omni.ja r,
   deny @{torbrowser_home_dir}/{browser/,}features/*.xpi r,
   deny @{torbrowser_home_dir}/TorBrowser/Data/Browser/profile.default/.parentlock rw,
   deny @{torbrowser_home_dir}/TorBrowser/Data/Browser/profile.default/extensions/*.xpi r,
   deny @{torbrowser_home_dir}/TorBrowser/Data/Browser/profile.default/startupCache/* r,
+  # Silence logs from included pluggable transports
+  deny /etc/hosts r,
+  deny /etc/services r,
 
   @{PROC}/sys/kernel/random/uuid r,
   /sys/devices/system/cpu/ r,