We have included a profile for /usr/lib/firefox/firefox.sh in the /etc/apparmor/profiles/extras directory. Profiles in this directory are not enforced by default, and are provided solely in case system administrators wish to use our profiles as a base.

We have decided to disable the firefox profile because users expect their web browsers to do many different things. What is acceptible for one user is not acceptible for another. If we ship a profile designed to least inconvenience users, the profile will provide very little security value -- except when firefox is run by root. If we ship a profile designed to provide reasonable security value, we will irritate an unreasonable number of users.

Thus, we've decided to have firefox be an 'opt-in' profile, rather than an 'opt-out' profile.

Thanks