mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2025-01-18 00:48:10 +01:00
doc: update variables ref & minor improvment.
This commit is contained in:
parent
5704d1ba20
commit
10d852ca1d
6 changed files with 53 additions and 19 deletions
|
@ -20,7 +20,7 @@ is therefore easy to ensure some profile features such as:
|
||||||
|
|
||||||
It also improves compatibilities and makes personalization easier thanks to the
|
It also improves compatibilities and makes personalization easier thanks to the
|
||||||
use of more variables.
|
use of more variables.
|
||||||
|
|
||||||
## Guidelines
|
## Guidelines
|
||||||
|
|
||||||
!!! note
|
!!! note
|
||||||
|
|
|
@ -24,16 +24,22 @@ The test VMs are built using [`cloud-init`][cloud-init] (when available), [`pack
|
||||||
[packer]: https://www.packer.io/
|
[packer]: https://www.packer.io/
|
||||||
[vagrant]: https://www.vagrantup.com/
|
[vagrant]: https://www.vagrantup.com/
|
||||||
|
|
||||||
|
### Requirements
|
||||||
|
|
||||||
### Build
|
* docker
|
||||||
|
* [packer]
|
||||||
|
* [vagrant]
|
||||||
|
* vagrant plugin install vagrant-libvirt
|
||||||
|
|
||||||
!!! note
|
!!! note
|
||||||
|
|
||||||
You may need to edit some settings to fit your setup:
|
You may need to edit some settings to fit your setup:
|
||||||
|
|
||||||
- The libvirt configuration in `tests/Vagrantfile`
|
- The libvirt configuration in `tests/Vagrantfile`
|
||||||
- The default ssh key and ISO directory in `tests/packer/variables.pkr.hcl`
|
- The default ssh key and ISO directory in `tests/packer/variables.pkr.hcl`
|
||||||
|
|
||||||
|
### Build
|
||||||
|
|
||||||
**Build an image**
|
**Build an image**
|
||||||
|
|
||||||
To build a VM image for development purpose, run the following from the `tests` directory:
|
To build a VM image for development purpose, run the following from the `tests` directory:
|
||||||
|
|
|
@ -55,6 +55,14 @@ dpkg-buildpackage -b -d --no-sign
|
||||||
sudo dpkg -i ../apparmor.d_*_all.deb
|
sudo dpkg -i ../apparmor.d_*_all.deb
|
||||||
```
|
```
|
||||||
|
|
||||||
|
!!! tip
|
||||||
|
|
||||||
|
If you have `devscripts` installed, you can use the one liner:
|
||||||
|
```sh
|
||||||
|
make dpkg
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## :simple-suse: OpenSUSE
|
## :simple-suse: OpenSUSE
|
||||||
|
|
||||||
|
@ -97,6 +105,13 @@ sudo make profile-names...
|
||||||
```
|
```
|
||||||
So, you can install the additional profiles `wl-copy`, `xclip`, `pass-import`, and `child-pager` if desired.
|
So, you can install the additional profiles `wl-copy`, `xclip`, `pass-import`, and `child-pager` if desired.
|
||||||
|
|
||||||
|
|
||||||
|
## Uninstall
|
||||||
|
|
||||||
|
- :material-arch: Archlinux `sudo pacman -R apparmor.d`
|
||||||
|
- :material-ubuntu: Ubuntu & :material-debian: Debian `sudo apt purge apparmor.d`
|
||||||
|
|
||||||
|
|
||||||
[aur]: https://aur.archlinux.org/packages/apparmor.d-git
|
[aur]: https://aur.archlinux.org/packages/apparmor.d-git
|
||||||
[repo]: https://repo.pujol.io/
|
[repo]: https://repo.pujol.io/
|
||||||
[keys]: https://repo.pujol.io/gpgkey
|
[keys]: https://repo.pujol.io/gpgkey
|
||||||
|
|
|
@ -12,7 +12,7 @@ Known bugs are tracked on the meta issue **[#75](https://github.com/roddhjav/app
|
||||||
However, there are some **major exceptions**:
|
However, there are some **major exceptions**:
|
||||||
|
|
||||||
* `deny` rules are enforced even in complain mode,
|
* `deny` rules are enforced even in complain mode,
|
||||||
* `attach_disconnected` (and `the mediate_deleted`) will break the program if they are required and missing in the profile,
|
* `attach_disconnected` (and `mediate_deleted`) will break the program if they are required and missing in the profile,
|
||||||
* If apparmor does not find the profile to transition `rPx`.
|
* If apparmor does not find the profile to transition `rPx`.
|
||||||
|
|
||||||
### Pacman "could not get current working directory"
|
### Pacman "could not get current working directory"
|
||||||
|
|
|
@ -108,7 +108,7 @@ DENIED dnsmasq open /proc/cmdline comm=dnsmasq requested_mask=r denied_mask=r
|
||||||
### Help
|
### Help
|
||||||
|
|
||||||
```
|
```
|
||||||
aa-log [-h] [--systemd] [--file file] [profile]
|
aa-log [-h] [--systemd] [--file file] [--rules] [profile]
|
||||||
|
|
||||||
Review AppArmor generated messages in a colorful way. Supports logs from
|
Review AppArmor generated messages in a colorful way. Supports logs from
|
||||||
auditd, systemd, syslog as well as dbus session events.
|
auditd, systemd, syslog as well as dbus session events.
|
||||||
|
@ -122,4 +122,5 @@ Options:
|
||||||
-h, --help Show this help message and exit.
|
-h, --help Show this help message and exit.
|
||||||
-f, --file FILE Set a logfile or a suffix to the default log file.
|
-f, --file FILE Set a logfile or a suffix to the default log file.
|
||||||
-s, --systemd Parse systemd logs from journalctl.
|
-s, --systemd Parse systemd logs from journalctl.
|
||||||
|
-r, --rules Convert the log into AppArmor rules.
|
||||||
```
|
```
|
||||||
|
|
|
@ -6,8 +6,8 @@ title: Variables References
|
||||||
|
|
||||||
### User directories
|
### User directories
|
||||||
|
|
||||||
| Description | Name | Value |
|
| Description | Name | Default Value |
|
||||||
|-------------|:----:|---------|
|
|-------------|:----:|---------------|
|
||||||
| Desktop | `@{XDG_DESKTOP_DIR}` | `Desktop` |
|
| Desktop | `@{XDG_DESKTOP_DIR}` | `Desktop` |
|
||||||
| Download | `@{XDG_DOWNLOAD_DIR}` | `Downloads` |
|
| Download | `@{XDG_DOWNLOAD_DIR}` | `Downloads` |
|
||||||
| Templates | `@{XDG_TEMPLATES_DIR}` | `Templates` |
|
| Templates | `@{XDG_TEMPLATES_DIR}` | `Templates` |
|
||||||
|
@ -27,8 +27,8 @@ title: Variables References
|
||||||
|
|
||||||
### Dotfiles
|
### Dotfiles
|
||||||
|
|
||||||
| Description | Name | Value |
|
| Description | Name | Default Value |
|
||||||
|-------------|:----:|---------|
|
|-------------|:----:|---------------|
|
||||||
| SSH | `@{XDG_SSH_DIR}` | `.ssh` |
|
| SSH | `@{XDG_SSH_DIR}` | `.ssh` |
|
||||||
| GPG | `@{XDG_GPG_DIR}` | `.gnupg` |
|
| GPG | `@{XDG_GPG_DIR}` | `.gnupg` |
|
||||||
| Passwords | `@{XDG_PASSWORD_STORE_DIR}` | `.password-store` |
|
| Passwords | `@{XDG_PASSWORD_STORE_DIR}` | `.password-store` |
|
||||||
|
@ -41,8 +41,8 @@ title: Variables References
|
||||||
|
|
||||||
### Full configuration path
|
### Full configuration path
|
||||||
|
|
||||||
| Description | Name | Value |
|
| Description | Name | Default Value |
|
||||||
|-------------|:----:|---------|
|
|-------------|:----:|---------------|
|
||||||
| Cache | `@{user_cache_dirs}` | `@{HOME}/@{XDG_CACHE_DIR}` |
|
| Cache | `@{user_cache_dirs}` | `@{HOME}/@{XDG_CACHE_DIR}` |
|
||||||
| Config | `@{user_config_dirs}` | `@{HOME}/@{XDG_CONFIG_DIR}` |
|
| Config | `@{user_config_dirs}` | `@{HOME}/@{XDG_CONFIG_DIR}` |
|
||||||
| Share | `@{user_share_dirs}` | ` @{HOME}/@{XDG_DATA_DIR}` |
|
| Share | `@{user_share_dirs}` | ` @{HOME}/@{XDG_DATA_DIR}` |
|
||||||
|
@ -55,8 +55,8 @@ title: Variables References
|
||||||
|
|
||||||
### Full user path
|
### Full user path
|
||||||
|
|
||||||
| Description | Name | Value |
|
| Description | Name | Default Value |
|
||||||
|-------------|:----:|---------|
|
|-------------|:----:|---------------|
|
||||||
| Books | `@{user_books_dirs}` | `@{HOME}/@{XDG_BOOKS_DIR} @{MOUNTS}/@{XDG_BOOKS_DIR}` |
|
| Books | `@{user_books_dirs}` | `@{HOME}/@{XDG_BOOKS_DIR} @{MOUNTS}/@{XDG_BOOKS_DIR}` |
|
||||||
| Documents | `@{user_documents_dirs}` | `@{HOME}/@{XDG_DOCUMENTS_DIR} @{MOUNTS}/@{XDG_DOCUMENTS_DIR}` |
|
| Documents | `@{user_documents_dirs}` | `@{HOME}/@{XDG_DOCUMENTS_DIR} @{MOUNTS}/@{XDG_DOCUMENTS_DIR}` |
|
||||||
| Download | `@{user_download_dirs}` | `@{HOME}/@{XDG_DOWNLOAD_DIR} @{MOUNTS}/@{XDG_DOWNLOAD_DIR}` |
|
| Download | `@{user_download_dirs}` | `@{HOME}/@{XDG_DOWNLOAD_DIR} @{MOUNTS}/@{XDG_DOWNLOAD_DIR}` |
|
||||||
|
@ -79,18 +79,30 @@ title: Variables References
|
||||||
|
|
||||||
Do not modify these variables unless you know what you are doing
|
Do not modify these variables unless you know what you are doing
|
||||||
|
|
||||||
| Description | Name | Value |
|
**Helper variables**
|
||||||
|-------------|:----:|---------|
|
|
||||||
| Root Home | `@{HOMEDIRS}` | `/home/` |
|
| Description | Name | Default Value |
|
||||||
| Home directories | `@{HOME}` | `@{HOMEDIRS}/*/ /root/` |
|
|-------------|:----:|---------------|
|
||||||
|
| Integer (up to 10 digits) | `@{int}` | `[0-9]{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}{[0-9],}` |
|
||||||
|
| Any 6, 8 or 10 characters | `@{rand6}`, `@{rand8}`, `@{rand10}` | |
|
||||||
|
| Hexadecimal | `@{h}*@{h}` | |
|
||||||
|
| MD5 hash | `@{md5}` | |
|
||||||
|
| Universally unique identifier | `@{uuid}` | |
|
||||||
| Current Process id | `@{pid}` | `[0-9]*` |
|
| Current Process id | `@{pid}` | `[0-9]*` |
|
||||||
| Processes ids | `@{pids}` | `[0-9]*` |
|
| Processes ids | `@{pids}` | `[0-9]*` |
|
||||||
| User id | `@{uid}` | `[0-9]*` |
|
| User id | `@{uid}` | `[0-9]*` |
|
||||||
| Thread id | `@{tid}` | `[0-9]*` |
|
| Thread id | `@{tid}` | `[0-9]*` |
|
||||||
|
| Single hexadecimal character | `@{h}` | `[0-9a-fA-F]` |
|
||||||
|
| Single alphanumeric character | `@{c}` | `[0-9a-zA-Z]` |
|
||||||
|
|
||||||
|
**System Paths**
|
||||||
|
|
||||||
|
| Description | Name | Default Value |
|
||||||
|
|-------------|:----:|---------------|
|
||||||
|
| Root Home | `@{HOMEDIRS}` | `/home/` |
|
||||||
|
| Home directories | `@{HOME}` | `@{HOMEDIRS}/*/ /root/` |
|
||||||
| Root Mountpoints | `@{MOUNTDIRS}` | `/media/ @{run}/media/ /mnt/` |
|
| Root Mountpoints | `@{MOUNTDIRS}` | `/media/ @{run}/media/ /mnt/` |
|
||||||
| Mountpoints directories | `@{MOUNTS}` | `@{MOUNTDIRS}/*/` |
|
| Mountpoints directories | `@{MOUNTS}` | `@{MOUNTDIRS}/*/` |
|
||||||
| Universally unique identifier | `@{uuid}` | `[0-9a-fA-F]*-[0-9a-fA-F]*-[0-9a-fA-F]*-[0-9a-fA-F]*-[0-9a-fA-F]*` |
|
|
||||||
| Hexadecimal | `@{hex}` | `[0-9a-fA-F]*` |
|
|
||||||
| Bin | `@{bin}` | `/{usr/,}{s,}bin` |
|
| Bin | `@{bin}` | `/{usr/,}{s,}bin` |
|
||||||
| Lib | `@{lib}` | `/{usr/,}lib{,exec,32,64}` |
|
| Lib | `@{lib}` | `/{usr/,}lib{,exec,32,64}` |
|
||||||
| multi-arch library | `@{multiarch}` | `*-linux-gnu*` |
|
| multi-arch library | `@{multiarch}` | `*-linux-gnu*` |
|
||||||
|
|
Loading…
Reference in a new issue