docs: some clarrification.
This commit is contained in:
parent
9727d1ce1f
commit
1223b70467
3 changed files with 28 additions and 3 deletions
|
|
@ -191,9 +191,7 @@ dynamically by the kernel. Therefore, the full range must be allowed:
|
||||||
|
|
||||||
*Source: [AppArmor Wiki][apparmor-wiki]*
|
*Source: [AppArmor Wiki][apparmor-wiki]*
|
||||||
|
|
||||||
This feature is only enabled when the `--full` option is passed to
|
This feature is only enabled when the profiles are built with `make full`. The profiles for full system policies are maintained in the **[`_full`][_full]** group. It consists of two extra main profiles:
|
||||||
the `configure` script. The profiles for full system policies are maintained in
|
|
||||||
the **[`_full`][_full]** group. It consists of two extra main profiles:
|
|
||||||
|
|
||||||
1. **`init`**: For systemd as PID 1
|
1. **`init`**: For systemd as PID 1
|
||||||
2. **`systemd`**: For systemd as user
|
2. **`systemd`**: For systemd as user
|
||||||
|
|
@ -201,6 +199,11 @@ the **[`_full`][_full]** group. It consists of two extra main profiles:
|
||||||
All core required applications that need to be started by systemd (both as user
|
All core required applications that need to be started by systemd (both as user
|
||||||
or root) need to be present in these profiles.
|
or root) need to be present in these profiles.
|
||||||
|
|
||||||
|
Early policy load should also be enabled. In `/etc/apparmor/parser.conf`
|
||||||
|
```
|
||||||
|
cache-loc /etc/apparmor/earlypolicy/
|
||||||
|
```
|
||||||
|
|
||||||
!!! danger
|
!!! danger
|
||||||
|
|
||||||
Full system policy is still under early development, do not run it outside a
|
Full system policy is still under early development, do not run it outside a
|
||||||
|
|
|
||||||
|
|
@ -10,6 +10,8 @@ The default package configuration installs all profiles in *complain* mode. This
|
||||||
|
|
||||||
When reporting issue. Please ensure the profiles are in complain mode
|
When reporting issue. Please ensure the profiles are in complain mode
|
||||||
|
|
||||||
|
## Install
|
||||||
|
|
||||||
#### :material-arch: Archlinux
|
#### :material-arch: Archlinux
|
||||||
|
|
||||||
In `PKGBUILD`, replace `make` by `make enforce`:
|
In `PKGBUILD`, replace `make` by `make enforce`:
|
||||||
|
|
@ -30,3 +32,17 @@ override_dh_auto_build:
|
||||||
#### :simple-suse: OpenSUSE & Partial install
|
#### :simple-suse: OpenSUSE & Partial install
|
||||||
|
|
||||||
Use the `make enforce` command to build instead of `make`
|
Use the `make enforce` command to build instead of `make`
|
||||||
|
|
||||||
|
## Track profiles in complain mode
|
||||||
|
|
||||||
|
The [`dists/flags`](https://github.com/roddhjav/apparmor.d/tree/main/dists/flags) directory tracks the profile that have been forced in complain mode. It is used for profile that are not considered stable. Files in this directory should respect the following format: `<profile> <flags>`, flags should be coma separated.
|
||||||
|
|
||||||
|
For instance, to move `adb` in complain mode, edit **[`dists/flags/main.flags`](https://github.com/roddhjav/apparmor.d/blob/main/dists/flags/main.flags)** and add the following line:
|
||||||
|
```sh
|
||||||
|
adb complain
|
||||||
|
```
|
||||||
|
|
||||||
|
Beware, flags defined in this file overwrite flags in the profile. So you may need to add other flags. Example for `gnome-shell`:
|
||||||
|
```sh
|
||||||
|
gnome-shell attach_disconnected,mediate_deleted,complain
|
||||||
|
```
|
||||||
|
|
|
||||||
|
|
@ -20,6 +20,7 @@ abstractions shipped with AppArmor must be installed.
|
||||||
The following desktop environments are supported:
|
The following desktop environments are supported:
|
||||||
|
|
||||||
- [x] :material-gnome: Gnome
|
- [x] :material-gnome: Gnome
|
||||||
|
- [ ] :simple-kde: KDE *(work in progress)*
|
||||||
|
|
||||||
Also, please note wayland has better support than xorg.
|
Also, please note wayland has better support than xorg.
|
||||||
|
|
||||||
|
|
@ -31,6 +32,11 @@ Also, please note wayland has better support than xorg.
|
||||||
## :material-arch: Archlinux
|
## :material-arch: Archlinux
|
||||||
|
|
||||||
`apparmor.d-git` is available in the [Arch User Repository][aur]:
|
`apparmor.d-git` is available in the [Arch User Repository][aur]:
|
||||||
|
```
|
||||||
|
yay -S apparmor.d-git # or your preferred AUR install method
|
||||||
|
```
|
||||||
|
|
||||||
|
Or without a AUR helper:
|
||||||
```sh
|
```sh
|
||||||
git clone https://aur.archlinux.org/apparmor.d-git.git
|
git clone https://aur.archlinux.org/apparmor.d-git.git
|
||||||
cd apparmor.d-git
|
cd apparmor.d-git
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue