Merge pull request #4148 from glitsj16/master

Improve comments in apparmor files

2 files changed, 9 insertions, 1 deletions

diff --git a/etc/apparmor/firejail-default b/etc/apparmor/firejail-default
index 80d527e41..ca32f5b0d 100644
--- a/etc/apparmor/firejail-default
+++ b/etc/apparmor/firejail-default
@@ -84,7 +84,8 @@ owner /proc/@{PID}/clear_refs w,
 
 ##########
 # Allow running programs only from well-known system directories. If you need
-# to run programs from your home directory, uncomment /home line.
+# to run programs from your home directory, add "/{,run/firejail/mnt/oroot/}home/** ix,"
+# or similar to /etc/apparmor.d/local/firejail-default (without the quotes).
 ##########
 /{,run/firejail/mnt/oroot/}{,usr/,usr/local/}bin/** ix,
 /{,run/firejail/mnt/oroot/}{,usr/,usr/local/}sbin/** ix,
diff --git a/etc/apparmor/firejail-local b/etc/apparmor/firejail-local
index 893a1ce46..7f2a778ab 100644
--- a/etc/apparmor/firejail-local
+++ b/etc/apparmor/firejail-local
@@ -1,5 +1,12 @@
 # Site-specific additions and overrides for 'firejail-default'.
 # For more details, please see /etc/apparmor.d/local/README.
 
+# Here are some examples to allow running programs from home directory.
+# Don't enable all of these, just pick a specific one or write a custom rule
+# instead as done below for torbrowser-launcher.
+#owner @HOME/** ix,
+#owner @HOME/bin/** ix
+#owner @HOME/.local/bin/** ix
+
 # Uncomment to opt-in to apparmor for torbrowser-launcher
 #owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/** ix,