mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-14 23:43:56 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity
large set of apparmor rules for various distros
2,498 Commits 7 Branches 0 Tags 14 MiB
Go 81.3%
Shell 9.7%
Jinja 4%
HCL 2.6%
Makefile 1.9%
Other 0.5%
d21af8246b
Go to file
Alexandre Pujol d21af8246b
Merge branch 'main' of github.com:roddhjav/apparmor.d 
* 'main' of github.com:roddhjav/apparmor.d:
  Reorganise based on type
  Add XDG_GAMES_DIR
  Add missing `user_games_dirs` and reorganise alphabetically
  add config dirs
  complete browsers
  fix lynx profile
  use strict abstraction
  add preview tools
2024-06-14 20:51:08 +01:00
.github ci: reenable build on ubuntu. 2024-05-08 20:47:45 +01:00
apparmor.d Merge branch 'main' of github.com:roddhjav/apparmor.d 2024-06-14 20:51:08 +01:00
cmd refractor(aa): move some test resource to the testdata dir. 2024-05-30 20:10:45 +01:00
debian chore: small fixes and cosmetic. 2024-06-04 20:01:05 +01:00
dists feat(profile): rewrite steam profiles. 2024-06-11 00:21:29 +01:00
docs Reorganise based on type 2024-06-14 19:12:15 +01:00
pkg fix: ensure filter directive get cleaned on build. 2024-06-14 20:50:17 +01:00
root/usr/share chore(aa-log): update shell completion. 2023-10-10 20:44:50 +01:00
systemd fix: do not force early load of userdbd as it can cause issues. 2024-03-21 23:22:08 +00:00
tests refractor(aa): move some test resource to the testdata dir. 2024-05-30 20:10:45 +01:00
.gitignore chore: update gitignore. 2024-04-02 13:44:27 +01:00
.gitlab-ci.yml ci: fix opensuse build & re-enable ubuntu preprocess. 2024-06-04 20:26:32 +01:00
.golangci.yaml chore: improve linter settings & better packer VM build. 2023-09-29 20:55:24 +01:00
go.mod fix: keep go 1.21. 2024-04-28 00:39:24 +01:00
go.sum chore: update go sum. 2024-04-28 00:37:07 +01:00
LICENSE Cleanup license file. 2021-04-01 14:47:01 +01:00
Makefile build: use the same technique to disable upstream profile on all distribution. 2024-06-04 19:52:06 +01:00
mkdocs.yml doc: add the abstactions page. 2024-03-24 15:21:31 +00:00
PKGBUILD build: ensure arch based build always works. 2023-07-08 22:59:54 +01:00
README.md Update README to follow index 2024-06-08 00:01:40 +01:00
requirements.txt doc: minify the doc website. 2023-10-09 22:07:45 +01:00

README.md

apparmor.d

Full set of AppArmor profiles

Warning

This project is still in its early development. Help is very welcome; see the documentation website including its development section.

Description

AppArmor.d is a set of over 1500 AppArmor profiles whose aim is to confine most Linux based applications and processes.

Purpose

  • Confine all root processes such as all systemd tools, bluetooth, dbus, polkit, NetworkManager, OpenVPN, GDM, rtkit, colord
  • Confine all Desktop environments
  • Confine all user services such as Pipewire, Gvfsd, dbus, xdg, xwayland
  • Confine some "special" user applications: web browsers, file managers, etc
  • Should not break a normal usage of the confined software

Goals

  • Target both desktops and servers
  • Support all distributions that support AppArmor:
    • Arch Linux
    • Ubuntu 22.04
    • Debian 12
    • OpenSUSE Tumbleweed
  • Support for all major desktop environments:
    • Gnome
    • KDE
    • XFCE (work in progress)
  • Fully tested (Work in progress)

This project is originally based on the work from Morfikov and aims to extend it to more Linux distributions and desktop environments.

Concepts

One profile a day keeps the hacker away

There are over 50000 Linux packages and even more applications. It is simply not possible to write an AppArmor profile for all of them. Therefore, a question arises:

What to confine and why?

We take inspiration from the Android/ChromeOS Security Model, and we apply it to the Linux world. Modern Linux security distributions usually consider an immutable core base image with a carefully selected set of applications. Everything else should be sandboxed. Therefore, this project tries to confine all the core applications you will usually find in a Linux system: all systemd services, xwayland, network, Bluetooth, your desktop environment... Non-core user applications are out of scope as they should be sandboxed using a dedicated tool (minijail, bubblewrap, toolbox...).

This is fundamentally different from how AppArmor is usually used on Linux servers as it is common to only confine the applications that face the internet and/or the users.

Presentations

Building the largest set of AppArmor profiles:

Installation

Please see apparmor.pujol.io/install

Configuration

Please see apparmor.pujol.io/configuration

Usage

Please see apparmor.pujol.io/usage

Contribution

Feedbacks, contributors, pull requests are all very welcome. Please read apparmor.pujol.io/development for more details on the contribution process.

Development chat available on https://matrix.to/#/#apparmor.d:matrix.org

License

This Project was initially based on Mikhail Morfikov's apparmor profiles project and thus has the same license (GPL2).