mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-14 23:43:56 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

docs: add Labelled programs section.

Browse Source
This commit is contained in:
Alexandre Pujol 2024-10-02 13:53:36 +01:00
parent 239ae17119
commit a5df9dc61e
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
docs/development/internal.md
View File

@ -42,7 +42,7 @@ Instead of allowing the ability to run all software in `@{bin}/`, the purpose of
@{bin}/flatpak rPx,
@{bin}/snap rPx,
# Labeled programs
# Labelled programs
@{archive_viewers_path} rPUx,
@{browsers_path} rPx,
@{document_viewers_path} rPUx,
@ -81,9 +81,6 @@ Instead of allowing the ability to run all software in `@{bin}/`, the purpose of
# Backup
@{lib}/deja-dup/deja-dup-monitor rPx,
@{browsers_path} rPx,
@{help_path} rPx,
```
### **`child-open-browsers`**
@ -155,6 +152,12 @@ Common `systemctl` action. Do not use it too much as most of the time you will n
It is recommended to transition [in a subprofile](abstractions.md#appsystemctl) everything that is not generic and that may require some access (so restart, enable...), while `child-systemctl` can handle the more basic tasks.
## Labelled programs
All common programs are tracked and labelled in the [`apparmor.d/tunables/multiarch.d/programs`](https://github.com/roddhjav/apparmor.d/blob/main/apparmor.d/tunables/multiarch.d/programs) and
[`apparmor.d/tunables/multiarch.d/paths`](https://github.com/roddhjav/apparmor.d/blob/main/apparmor.d/tunables/multiarch.d/paths) files. They can be used in a `child-open` profile or directly in a profile. They are useful to allow opening resources using a kind of program (browsers, image viewer, text editor...), instead of allowing a given program path.
## User Confinement [:material-police-badge-outline:{ .pg-red }](../full-system-policy.md "Only for Full System Policy (FSP)")
!!! warning "TODO"