Prevent spawning Unsafe Browser from main apps

boyska
2026-03-18T14:31:59Z

As per https://gitlab.tails.boum.org/tails/tails/-/merge_requests/956#note_198972 , some apps (LibreOffice for sure; Thunderbird has not been tested) can spawn Unsafe Browser. This is a security problem that can lead to deanonymization, ...

As per !956 (comment 198972) , some apps (LibreOffice for sure; Thunderbird has not been tested) can spawn Unsafe Browser. This is a security problem that can lead to deanonymization, e.g. via the accessibility bus (if enabled).

Improving the AppArmor profile should be enough.

But we've thought of a more elegant and possibly more maintainable approach on !989 (closed). The last plan there is an allow-list approach, that does not need AppArmor 3.0, that is safe vs. PID cycles, and does not require hardening AppArmor profiles for risky apps:

Scrap most of the !989 (closed) branch

Run GNOME Shell and TCA portal under almost-dummy AppArmor profiles, that:

allow everything

when executing Unsafe Browser, transition to a specific AppArmor profile (not the one that it would get by default if I started Unsafe Browser in a Terminal)

Unsafe Browser script: abort unless running under this specific AppArmor profile

AppArmor policy: by default, don't apply any profile to the Unsafe Browser

Only root can run a program under an AppArmor profile of their choice, so this should be safe.