mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-02-28 20:54:43 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

chore(fsp): add note of current profile stage.

Browse source
This commit is contained in:
Alexandre Pujol 2024-10-03 13:09:20 +01:00
parent cc5416f57a
commit 9b57546312
Failed to generate hash of commit
2 changed files with 13 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
apparmor.d/groups/_full/systemd
View file

@ -11,6 +11,17 @@
# Distributions and other programs can add rules in the usr/systemd.d directory
# TODO: rework this to get a controlled environment: (cf security model)
# - No global allow anymore: in high security environments, we must manage the list
# of program/service that can be started by systemd and ensure that they are all
# listed and confined. Programs not listed will not be able to start.
# - Outside common systemd service, the list may have to be automatically
# generated at install time, in `/etc/apparmor.d/usr/systemd.d/exec`
# - Stop disabling nnp flags in systemd dropin files.
# - Each systemd services in `systemd-service` (when the service is more complex than foo.service -> Exec=/usr/bin/foo)
# need they own profile, profile name configured as a dropin unit file.
# - When this is done: the fallback profile as root will not be needed.
abi <abi/4.0>,
include <tunables/global>

2
apparmor.d/groups/_full/systemd-user
View file

@ -11,6 +11,8 @@
# Distributions and other programs can add rules in the usr/systemd-user.d directory
# TODO: rework this to get a controlled environment. cf comments in systemd profile.
abi <abi/4.0>,
include <tunables/global>