This is intended, since this is the location that Tor Browser executes from and libraries and other files related to Tor Browser are stored it needs to be able to read this directory, this is explicitly defined in the AppArmor profile that's provided for Tor Browser in /etc/apparmor.d/torbrowser
:
/usr/local/lib/tor-browser/ r,
/usr/local/lib/tor-browser/** r,
/usr/local/lib/tor-browser/*.so{,.6} mr,
/usr/local/lib/tor-browser/**/*.so mr,
/usr/local/lib/tor-browser/browser/* r,
/usr/local/lib/tor-browser/TorBrowser/Data/Browser/profiles.ini r,
This provides only read access, as such Tor Browser can read these files but cannot change them.
Similarly, other parts of the amnesia
user's home folder are denied with explicit exceptions set for ~/Tor Browser
, ~/Persistent/Tor Browser
and the ammesia
user's local Tor Browser profile:
owner "@{HOME}/Tor Browser/" rw,
owner "@{HOME}/Tor Browser/**" rwk,
owner "@{HOME}/Persistent/Tor Browser/" rw,
owner "@{HOME}/Persistent/Tor Browser/**" rwk,
owner "/live/persistence/TailsData_unlocked/Persistent/Tor Browser/" rw,
owner "/live/persistence/TailsData_unlocked/Persistent/Tor Browser/**" rwk,
owner @{HOME}/.mozilla/firefox/bookmarks/** rwk,
owner /live/persistence/TailsData_unlocked/bookmarks/** rwk,
owner @{HOME}/.tor-browser/profile.default/ r,
owner @{HOME}/.tor-browser/profile.default/** rwk,