I am using the default AppArmor Firefox profile, which is supposed to only allow downloads to be saved to ~/Downloads. However, I can still download to any location within my home directory. I checked that everything was loaded and enforced. For test purposes, I added an explicit deny deny @{HOME}/Dropbox/** w and reloaded. That worked, I can no longer save anything anywhere within the Dropbox directory. I removed my test deny and commented out the 'Default profile allows downloads to ... and uploads from ...' section to see what happens:#owner @{HOME}/ r,#owner @{HOME}/Public/ r,#owner @{HOME}/Public/* r,#owner @{HOME}/Downloads/ r,#owner @{HOME}/Downloads/* rw,As suspected, nothing changed. I figured it must be some accidental allow on the home directory. I reset my changes and tried to find all lines with HOME related to the Firefox profile:grep 'HOME' $(grep include usr.bin.firefox | sed 's/^.*<\(.*\)>.*/\1/g') usr.bin.firefoxabstractions/audio:owner @{HOME}/.esd_auth r,abstractions/audio:owner @{HOME}/.asoundrc r,abstractions/audio:owner @{HOME}/.cache/event-sound-cache.* rwk,abstractions/audio:owner @{HOME}/.pulse-cookie rwk,abstractions/audio:owner @{HOME}/.pulse/ rw,abstractions/audio:owner @{HOME}/.pulse/* rwk,abstractions/audio:owner @{HOME}/.config/pulse/cookie rwk,abstractions/audio:owner @{HOME}/.alsoftrc r,abstractions/cups-client:  owner @{HOME}/.cups/client.conf r,abstractions/cups-client:  owner @{HOME}/.cups/lpoptions r,abstractions/gnome:  owner @{HOME}/.gnome/Gnome            r,abstractions/gnome:  owner @{HOME}/.gtk                    r,abstractions/gnome:  owner @{HOME}/.gtkrc                  r,abstractions/gnome:  owner @{HOME}/.gtkrc-2.0              r,abstractions/gnome:  owner @{HOME}/.gtk-bookmarks          r,abstractions/gnome:  owner @{HOME}/.themes/                r,abstractions/gnome:  owner @{HOME}/.themes/**              r,abstractions/gnome:  owner @{HOME}/.config/gtk-2.0/**                  r,abstractions/gnome:  owner @{HOME}/.config/gtk-2.0/gtkfilechooser.ini* rw,abstractions/gnome:  owner @{HOME}/.gconfd/lock/*                      r,abstractions/gnome:  owner @{HOME}/.gnome/application-info             r,abstractions/gnome:  owner @{HOME}/.fonts.cache-*    rwl,abstractions/ibus:  owner @{HOME}/.config/ibus/ r,abstractions/ibus:  owner @{HOME}/.config/ibus/bus/ rw,abstractions/ibus:  owner @{HOME}/.config/ibus/bus/* rw,usr.bin.firefox:  owner @{HOME}/.local/share/applications/defaults.list r,usr.bin.firefox:  owner @{HOME}/.local/share/applications/mimeapps.list r,usr.bin.firefox:  owner @{HOME}/.local/share/applications/mimeinfo.cache r,usr.bin.firefox:  deny @{HOME}/.local/share/recently-used.xbel r,usr.bin.firefox:  owner @{HOME}/.thumbnails/*/*.png r,usr.bin.firefox:  owner @{HOME}/ r,usr.bin.firefox:  owner @{HOME}/Public/ r,usr.bin.firefox:  owner @{HOME}/Public/* r,usr.bin.firefox:  owner @{HOME}/Downloads/ r,usr.bin.firefox:  owner @{HOME}/Downloads/* rw,usr.bin.firefox:  owner @{HOME}/.{firefox,mozilla}/ rw,usr.bin.firefox:  owner @{HOME}/.{firefox,mozilla}/** rw,usr.bin.firefox:  owner @{HOME}/.{firefox,mozilla}/**/*.{db,parentlock,sqlite}* k,usr.bin.firefox:  owner @{HOME}/.{firefox,mozilla}/plugins/** rm,usr.bin.firefox:  owner @{HOME}/.{firefox,mozilla}/**/plugins/** rm,usr.bin.firefox:  owner @{HOME}/.gnome2/firefox*-bin-* rw,usr.bin.firefox:  owner @{HOME}/.cache/mozilla/{,firefox/} rw,usr.bin.firefox:  owner @{HOME}/.cache/mozilla/firefox/** rw,usr.bin.firefox:  owner @{HOME}/.cache/mozilla/firefox/**/*.sqlite k,usr.bin.firefox:  owner @{HOME}/.mozilla/**/extensions/** mixr,I do not see anything that would allow firefox to write anywhere in HOME. Any ideas?Technical info:$ uname -r3.16.0-38-genericLinux Mint 17.2 with XFCEOther notes:On my laptop, I have Debian Jessie with Gnome and AppArmor seems to behave better. Although I did not use the default firefox profile on that machine, I made one that looks pretty similar for firefox-esr/iceweasel. It works as expected.Profile: http://pastebin.com/XFJgWJbn
AppArmor Firefox profile allows read and write to anywhere in HOME unless explicit deny used
security;apparmor