This seems to fix it, even though there was already a default apparmor config for Firefox (which looked _very_ familiar).

Thanks!