Description of problem:

Fedora 27 broke sandboxing firefox. This worked in all previous releases.

The firefox window is all black when run in a sandbox. After tweaking policy to permit mmapping files in tmpfs, things become visible in the window. However, https connections fail.

Running using unconfined_t works fine. sandbox_web_t and sandbox_x_t both fail.

How reproducible:

Every time

Steps to Reproduce:

1. sandbox -H foo -T bar -t sandbox_web_t -X firefox

Actual results:

Initially black screen. After tweaking policy, http connections do not work.

Expected results:

Working browser.

Additional info:

The audit log contains a message that sandboxX.sh has been denied an nnp_transition.