Security-Enhanced Linux secures the mozilla processes via flexible mandatory access control.
If you want to allow confined web browsers to read home directory content, you must turn on the mozilla_read_content boolean.
setsebool -P mozilla_read_content 1
If you want to allow unconfined users to transition to the Mozilla plugin domain when running xulrunner plugin-container, you must turn on the unconfined_mozilla_plugin_transition boolean.
setsebool -P unconfined_mozilla_plugin_transition 1
If you want to allow mozilla_plugins to create random content in the users home directory, you must turn on the mozilla_plugin_enable_homedirs boolean.
setsebool -P mozilla_plugin_enable_homedirs 1
If you want to allow mozilla plugin domain to connect to the network using TCP, you must turn on the mozilla_plugin_can_network_connect boolean.
setsebool -P mozilla_plugin_can_network_connect 1
If you want to allow users to resolve user passwd entries directly from ldap rather then using a sssd serve for the mozilla_plugin_config_t, mozilla_t, mozilla_plugin_t, you must turn on the authlogin_nsswitch_use_ldap boolean.
setsebool -P authlogin_nsswitch_use_ldap 1
If you want to allow confined applications to run with kerberos for the mozilla_plugin_config_t, mozilla_t, mozilla_plugin_t, you must turn on the kerberos_enabled boolean.
setsebool -P kerberos_enabled 1
You can see the context of a file using the -Z option to lsP Policy governs the access confined processes have to these files. SELinux mozilla policy is very flexible allowing users to setup their mozilla processes in as secure a method as possible.
The following file types are defined for mozilla:
mozilla_conf_t
- Set files with the mozilla_conf_t type, if you want to treat the files as mozilla configuration data, usually stored under the /etc directory.
mozilla_exec_t
- Set files with the mozilla_exec_t type, if you want to transition an executable to the mozilla_t domain.
mozilla_home_t
- Set files with the mozilla_home_t type, if you want to store mozilla files in the users home directory.
mozilla_plugin_config_exec_t
- Set files with the mozilla_plugin_config_exec_t type, if you want to transition an executable to the mozilla_plugin_config_t domain.
mozilla_plugin_exec_t
- Set files with the mozilla_plugin_exec_t type, if you want to transition an executable to the mozilla_plugin_t domain.
mozilla_plugin_rw_t
- Set files with the mozilla_plugin_rw_t type, if you want to treat the files as mozilla plugin read/write content.
mozilla_plugin_tmp_t
- Set files with the mozilla_plugin_tmp_t type, if you want to store mozilla plugin temporary files in the /tmp directories.