felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(fsp): systemd drop in files: configure stacked profile

Browse source 
It comes as a replacement of old and unsecure config that was disabling the nnp flag.
The new solution is:
1. Safe
2. Scalable  as hundred of profile could be configured this way
This commit is contained in:
Alexandre Pujol 2025-05-26 23:31:35 +02:00
parent 4ffbf84a00
commit 8f3f3816ed
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
29 changed files with 29 additions and 38 deletions
Download patch file Download diff file Expand all files Collapse all files

2
systemd/full/system/ModemManager.service
View file

@ -1,2 +1,2 @@
[Service] [Service]
NoNewPrivileges=no AppArmorProfile=&ModemManager

2
systemd/full/system/archlinux-keyring-wkd-sync.service
View file

@ -1,2 +1,2 @@
[Service] [Service]
NoNewPrivileges=no AppArmorProfile=&archlinux-keyring-wkd-sync

2
systemd/full/system/dbus-org.freedesktop.hostname1.service
View file

@ -1,2 +1,2 @@
[Service] [Service]
NoNewPrivileges=no AppArmorProfile=&systemd-hostnamed

2
systemd/full/system/dbus-org.freedesktop.import1.service
View file

@ -1,2 +1,2 @@
[Service] [Service]
NoNewPrivileges=no AppArmorProfile=&systemd-importd

2
systemd/full/system/dbus-org.freedesktop.locale1.service
View file

@ -1,2 +1,2 @@
[Service] [Service]
NoNewPrivileges=no AppArmorProfile=&systemd-localed

2
systemd/full/system/dbus-org.freedesktop.login1.service
View file

@ -1,2 +1,2 @@
[Service] [Service]
NoNewPrivileges=no AppArmorProfile=&systemd-logind

2
systemd/full/system/dbus-org.freedesktop.machine1.service
View file

@ -1,2 +1,2 @@
[Service] [Service]
NoNewPrivileges=no AppArmorProfile=&systemd-machined

2
systemd/full/system/dbus-org.freedesktop.timedate1.service
View file

@ -1,2 +1,2 @@
[Service] [Service]
NoNewPrivileges=no AppArmorProfile=&systemd-timedated

2
systemd/full/system/e2scrub@.service
View file

@ -1,2 +1,2 @@
[Service] [Service]
NoNewPrivileges=no AppArmorProfile=&e2scrub

2
systemd/full/system/e2scrub_reap.service
View file

@ -1,2 +1,2 @@
[Service] [Service]
NoNewPrivileges=no AppArmorProfile=&e2scrub_all

2
systemd/full/system/fprintd.service
View file

@ -1,2 +1,2 @@
[Service] [Service]
NoNewPrivileges=no AppArmorProfile=&fprintd

4
systemd/full/system/fwupd-refresh.service
View file

@ -1,4 +1,2 @@
[Service] [Service]
ProtectKernelModules=no AppArmorProfile=&fwupdmgr
RestrictRealtime=no
ProtectKernelModules=no

6
systemd/full/system/geoclue.service
View file

@ -1,6 +1,2 @@
[Service] [Service]
NoNewPrivileges=no AppArmorProfile=&geoclue
MemoryDenyWriteExecute=no
ProtectKernelTunables=no
ProtectKernelModules=no
RestrictRealtime=no

2
systemd/full/system/irqbalance.service
View file

@ -1,2 +1,2 @@
[Service] [Service]
NoNewPrivileges=no AppArmorProfile=&irqbalance

2
systemd/full/system/nm-priv-helper.service
View file

@ -1,2 +1,2 @@
[Service] [Service]
NoNewPrivileges=no AppArmorProfile=&nm-priv-helper

2
systemd/full/system/polkit.service
View file

@ -1,2 +1,2 @@
[Service] [Service]
NoNewPrivileges=no AppArmorProfile=&polkitd

2
systemd/full/system/rngd.service
View file

@ -1,2 +1,2 @@
[Service] [Service]
NoNewPrivileges=no AppArmorProfile=&rngd

2
systemd/full/system/systemd-homed.service
View file

@ -1,2 +1,2 @@
[Service] [Service]
NoNewPrivileges=no AppArmorProfile=&systemd-homed

2
systemd/full/system/systemd-hostnamed.service
View file

@ -1,2 +1,2 @@
[Service] [Service]
NoNewPrivileges=no AppArmorProfile=&systemd-hostnamed

3
systemd/full/system/systemd-journald.service
View file

@ -1,3 +1,2 @@
[Service] [Service]
NoNewPrivileges=no AppArmorProfile=&systemd-journald
ProtectClock=no

3
systemd/full/system/systemd-journald@.service
View file

@ -1,3 +1,2 @@
[Service] [Service]
NoNewPrivileges=no AppArmorProfile=&systemd-journald
ProtectClock=no

2
systemd/full/system/systemd-localed.service
View file

@ -1,2 +1,2 @@
[Service] [Service]
NoNewPrivileges=no AppArmorProfile=&systemd-localed

3
systemd/full/system/systemd-logind.service
View file

@ -1,3 +1,2 @@
[Service] [Service]
NoNewPrivileges=no AppArmorProfile=&systemd-logind
ProtectClock=no

2
systemd/full/system/systemd-machined.service
View file

@ -1,2 +1,2 @@
[Service] [Service]
NoNewPrivileges=no AppArmorProfile=&systemd-machined

2
systemd/full/system/systemd-networkd.service
View file

@ -1,2 +1,2 @@
[Service] [Service]
NoNewPrivileges=no AppArmorProfile=&systemd-networkd

2
systemd/full/system/systemd-resolved.service
View file

@ -1,2 +1,2 @@
[Service] [Service]
NoNewPrivileges=no AppArmorProfile=&systemd-resolved

2
systemd/full/system/systemd-timedated.service
View file

@ -1,2 +1,2 @@
[Service] [Service]
NoNewPrivileges=no AppArmorProfile=&systemd-timedated

2
systemd/full/system/systemd-userdbd.service
View file

@ -1,2 +1,2 @@
[Service] [Service]
NoNewPrivileges=no AppArmorProfile=&systemd-userdbd

2
systemd/full/system/upower.service
View file

@ -1,2 +1,2 @@
[Service] [Service]
NoNewPrivileges=no AppArmorProfile=&upowerd