I'm having fun writing AppArmor profile for firefox.I like to open downloaded files directly from firefox (by double-click on it), it is really convenient. But then firefox should have permissions to execute applications.Say, for opening pdf files, I should write:/usr/bin/evince rmix,And similar rule for opening images, archives, etc.But, I can't predict everything, so, one day firefox will be failed to open some file.I can write something like/usr/bin/* rmix,but I don't like that. The best solution to me is to explicitly allow most often used applications (such as evince, etc), but for all the rest let AppArmor to ask me interactively. It is better than just denying or allowing.Is that possible?
AppArmor: make it ask me for decision to allow/disallow
security;apparmor