Skip to content

nobody43/apparmor-profiles

Folders and files

NameName
Last commit message
Last commit date

Latest commit

34573f9 · Oct 25, 2022

History

80 Commits
Nov 22, 2021
Jul 24, 2021
Jan 10, 2022
Nov 22, 2021
Mar 22, 2022
Oct 25, 2022
Jan 10, 2022
Jul 21, 2021
Nov 22, 2021
Nov 22, 2021
Nov 22, 2021
Jul 16, 2021
Nov 22, 2021
Nov 22, 2021
Aug 3, 2021
Aug 19, 2021

Repository files navigation

apparmor-profiles

This repository is an experimental downstream of apparmor.d project.

Prerequisites

# apt install apparmor-utils

Testing

# mv usr.bin.curl /etc/apparmor.d/
# aa-complain /etc/apparmor.d/usr.bin.curl

Error log is /var/log/syslog by default.

Installation

# aa-enforce /etc/apparmor.d/usr.bin.curl

Profiles

WARNING: custom applications might fail without adjustment!

Dependencies

  • abstractions/3rd/nameservice-strict

Compatibility

  • Pi-hole (commented out by default)

Tested on

  • Debian 10
  • Armbian Buster
  • Xubuntu 21.04 (commented out by default)

Snap releases are not supported.

Dependencies

  • abstractions/3rd/file-chooser
  • abstractions/3rd/nameservice-strict
  • local/usr.lib.libreoffice.program.soffice.bin
  • usr.bin.ristretto

Options

  • write access on home
  • interactive file-chooser dialog
  • opening files with xdg-open
  • various sanitized_helper transitions
  • disabled dbus-overwrite

Tested on

  • Xubuntu 21.04
  • Ubuntu 21.04

Options

  • file deletion by write access
  • editing with dash transition
  • disabled interactive file-chooser dialog

Tested on

  • Debian 10
  • Xubuntu 21.04-21.10

Without NetworkManager. Without interactive credentials supplying, so be sure to provide them in config with auth-user-pass.

Dependencies

  • abstractions/3rd/nameservice-strict

Tested on

  • Debian 10-11

Without transfers.

Tested on

  • Debian 10-11

No auto-update and debug. No access to browser cookies ATM.

Dependencies

  • abstractions/3rd/nameservice-strict

Options

  • disabled --exec
  • disabled .netrc auth

Compatibility

  • yt-dlp

Tested on

  • Debian 10
  • Xubuntu 21.04-21.10
  • Ubuntu 21.04

Flatpack releases are not supported.

Dependencies

  • abstractions/3rd/nameservice-strict
  • usr.local.bin.youtube-dl

Options

  • disabled interactive file-chooser dialog
  • disabled dbus-overwrite
  • disabled qt5-settings-write
  • disabled network access

Tested on

  • Debian 10
  • Xubuntu 21.04-21.10
  • Ubuntu 21.04

pip version only.

Tested on

  • Debian 10
  • Xubuntu 21.10

Tested on

  • Debian 10-11
  • Xubuntu 21.10

No DBus or ICE.

Tested on

  • Debian 11

Links