98e59e9336
* Update plasmashell
* Update akonadi_akonotes_resource
* Update akonadi_archivemail_agent
* Update akonadi_birthdays_resource
* Update akonadi_contacts_resource
* Update akonadi_control
* Update akonadi_followupreminder_agent
* Update akonadi_ical_resource
* Update akonadi_indexing_agent
* Update akonadi_maildir_resource
* Update akonadi_maildispatcher_agent
* Update akonadi_mailfilter_agent
* Update akonadi_mailmerge_agent
* Update akonadi_migration_agent
* Update akonadi_newmailnotifier_agent
* Update akonadi_sendlater_agent
* Update akonadi_unifiedmailbox_agent
* Revert change
* Revert change
* Revert change
* Revert change
* Revert change and add dri-enumerate abstraction
* Revert change
* Revert change and add dri-enumerate abstraction
* Revert change
* Revert change
* Revert change
* Revert change
* Revert change and add dri-enumerate abstraction
* Revert change
* Revert change
* Revert change
* Revert change
* Removing /usr/share/icons/{,**} again
* Adding the audio abstraction
* Adding the consoles abstraction
* plasmashell: adding back /dev/shm/ r, and /dev/ptmx rw,
* akonadi_mailfilter_agent: removing the user-tmp abstraction
I haven't been able to observe new related requests.
---------
Co-authored-by: Alex <roddhjav@users.noreply.github.com>
|
||
|---|---|---|
| .github | ||
| apparmor.d | ||
| cmd | ||
| debian | ||
| dists | ||
| docs | ||
| pkg | ||
| root | ||
| systemd | ||
| tests | ||
| .gitignore | ||
| .gitlab-ci.yml | ||
| .golangci.yaml | ||
| go.mod | ||
| go.sum | ||
| LICENSE | ||
| Makefile | ||
| mkdocs.yml | ||
| PKGBUILD | ||
| README.md | ||
| requirements.txt | ||
apparmor.d
Full set of AppArmor profiles
Warning
welcome; see the documentation website including its development section.
Description
AppArmor.d is a set of over 1400 AppArmor profiles whose aim is to confine most Linux based applications and processes.
Purpose
- Confine all root processes such as all
systemdtools,bluetooth,dbus,polkit,NetworkManager,OpenVPN,GDM,rtkit,colord - Confine all Desktop environments
- Confine all user services such as
Pipewire,Gvfsd,dbus,xdg,xwayland - Confine some "special" user applications: web browser, file browser...
- Should not break a normal usage of the confined software
Goals
- Target both desktops and servers
- Support all distributions that support AppArmor:
- Archlinux
- Ubuntu 22.04
- Debian 11
- OpenSUSE Tumbleweed
- Support all major desktop environments:
- Currently only Gnome
- Fully tested (Work in progress)
This project is originaly based on the work from Morfikov and aims to extend it to more Linux distributions and desktop environements.
Concepts
One profile a day keeps the hacker away
There are over 50000 Linux packages and even more applications. It is simply not possible to write an AppArmor profile for all of them. Therefore, a question arises:
What to confine and why?
We take inspiration from the Android/ChromeOS Security Model and we apply it to the Linux world. Modern Linux security distributions usually consider an immutable core base image with a carefully selected set of applications. Everything else should be sandboxed. Therefore, this project tries to confine all the core applications you will usually find in a Linux system: all systemd services, xwayland, network, bluetooth, your desktop environment... Non-core user applications are out of scope as they should be sandboxed using a dedicated tool (minijail, bubblewrap, toolbox...).
This is fundamentally different from how AppArmor is usually used on Linux servers as it is common to only confine the applications that face the internet and/or the users.
Presentation
- Building the largest working set of AppArmor profiles Linux Security Summit North America (LSS-NA 2023) (Slide)
Installation
Please see apparmor.pujol.io/install
Configuration
Please see apparmor.pujol.io/configuration
Usage
Please see apparmor.pujol.io/usage
Contribution
Feedbacks, contributors, pull requests are all very welcome. Please read apparmor.pujol.io/development for more details on the contribution process.
License
This Project was initially based on Mikhail Morfikov's apparmor profiles project and thus has the same license (GPL2).