@xj9 I wrote an apparmor profile for Firefox a couple years ago, it worked for a while and then they made it pull in all kinds of shit like dbus and I couldn't effectively restrict it before. I need to go back and just make it block /home except for the directories you mentioned, though.