apparmor: don't allow mounts and paths manipulation

AppArmor security relies on path based rules and rewriting paths
may allow to bypass them.

Those actions are priveliged so vast majority of apps shouldn't need
them anyway. If some app need those rules then it's better to
consider them as unsuitable for apparmor option rather than weaken
generic profile for all apps.

See related issue reported by apparmor usage in snap:
https://bugs.launchpad.net/snapd/+bug/1791711

1 files changed, 0 insertions, 8 deletions

diff --git a/etc/firejail-default b/etc/firejail-default
index 66be8ba9c..3321b72fb 100644
--- a/etc/firejail-default
+++ b/etc/firejail-default
@@ -151,14 +151,6 @@ capability setfcap,
 #capability mac_override,
 #capability mac_admin,
 
-##########
-# We let Firejail deal with mount/umount functionality.
-##########
-mount,
-remount,
-umount,
-pivot_root,
-
 # Site-specific additions and overrides. See local/README for details.
 #include <local/firejail-local>
 }