Unsafe Browser: try blocking D-Bus session access with AppArmor

intrigeri
2026-05-05T09:39:38Z

For context, on tails/tails#21439 our conclusion for Unsafe Browser was: > * On top of AppArmor, we have a bwrap sandbox, but it's mostly useless since it does `--bind / /`. See what we currently expect from the AppArmor profile: https:...

For context, on #21439 (closed) our conclusion for Unsafe Browser was:

On top of AppArmor, we have a bwrap sandbox, but it's mostly useless since it does --bind / /. See what we currently expect from the AppArmor profile: https://tails.net/contribute/design/Unsafe_Browser/#index2h2.

The Unsafe Browser probably does not need D-Bus session access, so we could block that.

Apart of that the AppArmor profile works fine, is not wide open, adds some plausibly meaningful security, and does not make UX too bad. So it looks like it's worth salvaging.

ACTION (short-term): try blocking D-Bus session access; if this fails, revisit the topic

ACTION (long-term, low priority, mostly useful as UX polishing): run as fake Flatpak (#19409)

This issue is about the "try blocking D-Bus session access; if this fails, revisit the topic" part.

To Do

Update design doc