mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-12-23 21:46:44 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
large set of apparmor rules for various distros
1492 commits 6 branches 0 tags 15 MiB
Go 76.5%
Shell 11.1%
Python 3.8%
Jinja 3.7%
HCL 2.5%
Other 2.4%
Find a file
Alexandre Pujol 64564095e6
fix(ci): all -> amd64.
2023-09-21 11:20:51 +01:00
.github fix(ci): all -> amd64. 2023-09-21 11:20:51 +01:00
apparmor.d fix(abs): SSD Nvme devices pci path. 2023-09-18 19:08:07 +01:00
cmd fix(test): remove unused const. 2023-09-10 12:36:16 +01:00
debian fix(build): ignore dwz compression in deb build. 2023-09-20 21:48:26 +01:00
dists fix(build): update backport repo. 2023-09-20 23:08:17 +01:00
docs doc: update integration test page. 2023-09-19 19:48:02 +01:00
pkg fix(build): fix unit test build. 2023-09-18 17:35:32 +01:00
root/usr/share feat: do not set autostart or read access to log by default 2023-07-23 16:37:09 +01:00
systemd feat(systemd): Set profile name for ibus gnome service. 2022-10-15 23:16:30 +01:00
tests build: add linter options. 2023-09-19 18:35:24 +01:00
.gitignore Update ignore and better defaults for mpv 2023-09-11 10:03:51 +01:00
.gitlab-ci.yml fix(build): update backport repo. 2023-09-20 23:08:17 +01:00
.golangci.yaml chore: fix go linter 2023-05-06 13:29:55 +01:00
go.mod chore: update go dependencies. 2023-09-04 15:03:22 +01:00
go.sum chore: update go dependencies. 2023-09-04 15:03:22 +01:00
LICENSE Cleanup license file. 2021-04-01 14:47:01 +01:00
Makefile build: add rpm packaging files. 2023-09-19 19:04:12 +01:00
mkdocs.yml docs: add integration initial page. 2023-04-16 22:38:20 +01:00
PKGBUILD build: ensure arch based build always works. 2023-07-08 22:59:54 +01:00
README.md chore: cosmetic. 2023-09-20 19:01:52 +01:00
requirements.txt docs: initial documentation website. 2023-01-29 21:18:22 +00:00

README.md

apparmor.d

Full set of AppArmor profiles

Warning

This project is still in its early development. Help is very welcome; see the documentation website including its development section.

Description

AppArmor.d is a set of over 1400 AppArmor profiles whose aim is to confine most Linux based applications and processes.

Purpose

  • Confine all root processes such as all systemd tools, bluetooth, dbus, polkit, NetworkManager, OpenVPN, GDM, rtkit, colord
  • Confine all Desktop environments
  • Confine all user services such as Pipewire, Gvfsd, dbus, xdg, xwayland
  • Confine some "special" user applications: web browser, file browser...
  • Should not break a normal usage of the confined software

Goals

  • Target both desktops and servers
  • Support all distributions that support AppArmor:
    • Archlinux
    • Ubuntu 22.04
    • Debian 12
    • OpenSUSE Tumbleweed
  • Support all major desktop environments:
    • Currently only Gnome
  • Fully tested (Work in progress)

This project is originaly based on the work from Morfikov and aims to extend it to more Linux distributions and desktop environements.

Concepts

One profile a day keeps the hacker away

There are over 50000 Linux packages and even more applications. It is simply not possible to write an AppArmor profile for all of them. Therefore, a question arises:

What to confine and why?

We take inspiration from the Android/ChromeOS Security Model and we apply it to the Linux world. Modern Linux security distributions usually consider an immutable core base image with a carefully selected set of applications. Everything else should be sandboxed. Therefore, this project tries to confine all the core applications you will usually find in a Linux system: all systemd services, xwayland, network, bluetooth, your desktop environment... Non-core user applications are out of scope as they should be sandboxed using a dedicated tool (minijail, bubblewrap, toolbox...).

This is fundamentally different from how AppArmor is usually used on Linux servers as it is common to only confine the applications that face the internet and/or the users.

Presentation

Installation

Please see apparmor.pujol.io/install

Configuration

Please see apparmor.pujol.io/configuration

Usage

Please see apparmor.pujol.io/usage

Contribution

Feedbacks, contributors, pull requests are all very welcome. Please read apparmor.pujol.io/development for more details on the contribution process.

License

This Project was initially based on Mikhail Morfikov's apparmor profiles project and thus has the same license (GPL2).