mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 08:58:15 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

doc: update guideline to the new bin and lib variables.

Browse source
This commit is contained in:
Alexandre Pujol 2023-07-09 15:04:06 +01:00
parent 2b2c42d23c
commit 64146be05a
Failed to generate hash of commit
5 changed files with 18 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
docs/configuration.md
View file

@ -92,7 +92,7 @@ your rules in it.
picture, books...) with some predefined GUI application. To allow it to open picture, books...) with some predefined GUI application. To allow it to open
URLs with Firefox, create the file `/etc/apparmor.d/local/child-open` with: URLs with Firefox, create the file `/etc/apparmor.d/local/child-open` with:
```sh ```sh
/{usr/,}bin/firefox rPx, @{bin}/firefox rPx,
``` ```
!!! note !!! note

2
docs/development/index.md
View file

@ -81,7 +81,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}bin/foo @{exec_path} = @{bin}/foo
profile foo @{exec_path} { profile foo @{exec_path} {
include <abstractions/base> include <abstractions/base>

16
docs/development/structure.md
View file

@ -46,11 +46,11 @@ our profile:
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>
/{usr/,}bin/ r, @{bin}/ r,
/{usr/,}bin/pager mr, @{bin}/pager mr,
/{usr/,}bin/less mr, @{bin}/less mr,
/{usr/,}bin/more mr, @{bin}/more mr,
/{usr/,}bin/diff mr, @{bin}/diff mr,
owner @{HOME}/.lesshs* rw, owner @{HOME}/.lesshs* rw,
@ -73,7 +73,7 @@ our profile:
[apparmor.d/apparmor.d/profiles-m-r/pass](https://github.com/roddhjav/apparmor.d/blob/accf5538bdfc1598f1cc1588a7118252884df50c/apparmor.d/profiles-m-r/pass#L20 [apparmor.d/apparmor.d/profiles-m-r/pass](https://github.com/roddhjav/apparmor.d/blob/accf5538bdfc1598f1cc1588a7118252884df50c/apparmor.d/profiles-m-r/pass#L20
) )
``` aa linenums="20" ``` aa linenums="20"
/{usr/,}bin/diff rix, @{bin}/diff rix,
``` ```
**What if I still want to protect these programs?** **What if I still want to protect these programs?**
@ -125,7 +125,7 @@ the following note:
Here is an overview of the current children profile: Here is an overview of the current children profile:
1. **`child-open`**: To open resources. Instead of allowing the run of all 1. **`child-open`**: To open resources. Instead of allowing the run of all
software in `/{usr/,}bin/`, the purpose of this profile is to list all GUI software in `@{bin}/`, the purpose of this profile is to list all GUI
programs that can open resources. Ultimately, only sandbox manager programs programs that can open resources. Ultimately, only sandbox manager programs
such as `bwrap`, `snap`, `flatpak`, `firejail` should be present here. Until such as `bwrap`, `snap`, `flatpak`, `firejail` should be present here. Until
this day, this profile will be a controlled mess. this day, this profile will be a controlled mess.
@ -147,7 +147,7 @@ This abstraction requires the following variables definied in the profile header
```sh ```sh
@{chromium_name} = chromium @{chromium_name} = chromium
@{chromium_domain} = org.chromium.Chromium @{chromium_domain} = org.chromium.Chromium
@{chromium_lib_dirs} = /{usr/,}lib/chromium @{chromium_lib_dirs} = @{lib}/chromium
@{chromium_config_dirs} = @{user_config_dirs}/chromium @{chromium_config_dirs} = @{user_config_dirs}/chromium
@{chromium_cache_dirs} = @{user_cache_dirs}/chromium @{chromium_cache_dirs} = @{user_cache_dirs}/chromium
``` ```

12
docs/install.md
View file

@ -87,12 +87,12 @@ sudo make profile-names...
For instance, `sudo make pass` gives: For instance, `sudo make pass` gives:
```sh ```sh
Warning: profile dependencies fallback to unconfined. Warning: profile dependencies fallback to unconfined.
/{usr/,}bin/wl-{copy,paste} rPx, @{bin}/wl-{copy,paste} rPx,
/{usr/,}bin/xclip rPx, @{bin}/xclip rPx,
/{usr/,}bin/python3.[0-9]* rPx -> pass-import, # pass-import @{bin}/python3.[0-9]* rPx -> pass-import, # pass-import
/{usr/,}bin/pager rPx -> child-pager, @{bin}/pager rPx -> child-pager,
/{usr/,}bin/less rPx -> child-pager, @{bin}/less rPx -> child-pager,
/{usr/,}bin/more rPx -> child-pager, @{bin}/more rPx -> child-pager,
'.build/apparmor.d/pass' -> '/etc/apparmor.d/pass' '.build/apparmor.d/pass' -> '/etc/apparmor.d/pass'
``` ```
So, you can install the additional profiles `wl-copy`, `xclip`, `pass-import`, and `child-pager` if desired. So, you can install the additional profiles `wl-copy`, `xclip`, `pass-import`, and `child-pager` if desired.

4
docs/variables.md
View file

@ -89,8 +89,8 @@ title: Variables References
| Mountpoints directories | `@{MOUNTS}` | `@{MOUNTDIRS}/*/` | | Mountpoints directories | `@{MOUNTS}` | `@{MOUNTDIRS}/*/` |
| Universally unique identifier | `@{uuid}` | `[0-9a-fA-F]*-[0-9a-fA-F]*-[0-9a-fA-F]*-[0-9a-fA-F]*-[0-9a-fA-F]*` | | Universally unique identifier | `@{uuid}` | `[0-9a-fA-F]*-[0-9a-fA-F]*-[0-9a-fA-F]*-[0-9a-fA-F]*-[0-9a-fA-F]*` |
| Hexadecimal | `@{hex}` | `[0-9a-fA-F]*` | | Hexadecimal | `@{hex}` | `[0-9a-fA-F]*` |
| Libexec *(Archlinux)* | `@{libexec}` | `/{usr/,}lib` | | Bin | `@{bin}` | `/{usr/,}{s,}bin` |
| Libexec *(Debian/Ubuntu)* | `@{libexec}` | `/{usr/,}libexec` | | Lib | `@{lib}` | `/{usr/,}lib{,exec,32,64}` |
| multi-arch library | `@{multiarch}` | `*-linux-gnu*` | | multi-arch library | `@{multiarch}` | `*-linux-gnu*` |
| Proc | `@{PROC}` | `/proc/` | | Proc | `@{PROC}` | `/proc/` |
| Run | `@{run}` | `/run/ /var/run/` | | Run | `@{run}` | `/run/ /var/run/` |