mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-14 23:43:56 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

docs: some clarrification.

Browse Source
This commit is contained in:
Alexandre Pujol 2023-04-24 12:18:57 +01:00
parent 9727d1ce1f
commit 1223b70467
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
3 changed files with 28 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
docs/development/structure.md
View File

@ -191,9 +191,7 @@ dynamically by the kernel. Therefore, the full range must be allowed:
*Source: [AppArmor Wiki][apparmor-wiki]*
This feature is only enabled when the `--full` option is passed to
the `configure` script. The profiles for full system policies are maintained in
the **[`_full`][_full]** group. It consists of two extra main profiles:
This feature is only enabled when the profiles are built with `make full`. The profiles for full system policies are maintained in the **[`_full`][_full]** group. It consists of two extra main profiles:
1. **`init`**: For systemd as PID 1
2. **`systemd`**: For systemd as user
@ -201,6 +199,11 @@ the **[`_full`][_full]** group. It consists of two extra main profiles:
All core required applications that need to be started by systemd (both as user
or root) need to be present in these profiles.
Early policy load should also be enabled. In `/etc/apparmor/parser.conf`
```
cache-loc /etc/apparmor/earlypolicy/
```
!!! danger
Full system policy is still under early development, do not run it outside a

16
docs/enforce.md
View File

@ -10,6 +10,8 @@ The default package configuration installs all profiles in *complain* mode. This
When reporting issue. Please ensure the profiles are in complain mode
## Install
#### :material-arch: Archlinux
In `PKGBUILD`, replace `make` by `make enforce`:
@ -30,3 +32,17 @@ override_dh_auto_build:
#### :simple-suse: OpenSUSE & Partial install
Use the `make enforce` command to build instead of `make`
## Track profiles in complain mode
The [`dists/flags`](https://github.com/roddhjav/apparmor.d/tree/main/dists/flags) directory tracks the profile that have been forced in complain mode. It is used for profile that are not considered stable. Files in this directory should respect the following format: `<profile> <flags>`, flags should be coma separated.
For instance, to move `adb` in complain mode, edit **[`dists/flags/main.flags`](https://github.com/roddhjav/apparmor.d/blob/main/dists/flags/main.flags)** and add the following line:
```sh
adb complain
```
Beware, flags defined in this file overwrite flags in the profile. So you may need to add other flags. Example for `gnome-shell`:
```sh
gnome-shell attach_disconnected,mediate_deleted,complain
```

6
docs/install.md
View File

@ -20,6 +20,7 @@ abstractions shipped with AppArmor must be installed.
The following desktop environments are supported:
- [x] :material-gnome: Gnome
- [ ] :simple-kde: KDE *(work in progress)*
Also, please note wayland has better support than xorg.
@ -31,6 +32,11 @@ Also, please note wayland has better support than xorg.
## :material-arch: Archlinux
`apparmor.d-git` is available in the [Arch User Repository][aur]:
```
yay -S apparmor.d-git # or your preferred AUR install method
```
Or without a AUR helper:
```sh
git clone https://aur.archlinux.org/apparmor.d-git.git
cd apparmor.d-git