docs: multiple english corrections.
Co-authored-by: Thomas LAURENT <thomas.laurent@ucdconnect.ie>
This commit is contained in:
Alexandre Pujol
parent
01419d82c4
commit
c0780edee1
11 changed files with 51 additions and 47 deletions
|
|
@ -25,13 +25,13 @@ use of more variables.
|
|||
|
||||
!!! note
|
||||
|
||||
This profile guideline is still evolving, feel free to propose improvement
|
||||
as long as it does not vary too much from the existing rules.
|
||||
This profile guideline is still evolving, feel free to propose improvements
|
||||
as long as they do not vary too much from the existing rules.
|
||||
|
||||
In order to ensure a common structure across the profiles, all new profile **must**
|
||||
follow the guidelines presented here.
|
||||
|
||||
The rules in the profile should be sorted in rule ***block*** as follow:
|
||||
The rules in the profile should be sorted in the rule ***block*** as follows:
|
||||
|
||||
- `include`
|
||||
- `set rlimit`
|
||||
|
|
@ -54,7 +54,7 @@ This rule order is taken from AppArmor with minor changes as we tend to:
|
|||
- Divide the file block in multiple subcategories
|
||||
- Put the block with the longer rules (`files`, `dbus`) after the other blocks
|
||||
|
||||
### The file blocks
|
||||
### The file block
|
||||
|
||||
The file block should be sorted as follow:
|
||||
|
||||
|
|
@ -90,7 +90,7 @@ dbus send bus=session path=/org/freedesktop/DBus
|
|||
```
|
||||
If there is no predictable label it can be omitted.
|
||||
|
||||
### Profiles rules
|
||||
### Profile rules
|
||||
|
||||
`bin, sbin & lib`
|
||||
|
||||
|
|
@ -103,7 +103,7 @@ If there is no predictable label it can be omitted.
|
|||
|
||||
`Sort`
|
||||
|
||||
: In a rule block, the rule shall be alphabetically sorted.
|
||||
: In a rule block, the rules must be alphabetically sorted.
|
||||
|
||||
`Sub profile`
|
||||
|
||||
|
|
@ -111,7 +111,7 @@ If there is no predictable label it can be omitted.
|
|||
|
||||
`Similar purpose`
|
||||
|
||||
: When some file access share similar purpose, they may be sorted together. Eg:
|
||||
: When some rules share similar purpose, they may be sorted together. Eg:
|
||||
```
|
||||
/etc/machine-id r,
|
||||
/var/lib/dbus/machine-id r,
|
||||
|
|
|
|||
|
|
@ -4,14 +4,14 @@ title: Development
|
|||
|
||||
# Development
|
||||
|
||||
You want to contribute to `apparmor.d`, **thank a lot for this.** Feedbacks,
|
||||
You want to contribute to `apparmor.d`, **thanks a lot for this.** Feedbacks,
|
||||
contributors, pull requests are all very welcome. You will find in this page all
|
||||
the useful information needed to contribute.
|
||||
|
||||
??? info "How to contribute"
|
||||
|
||||
1. If you don't have git on your machine, [install it][git].
|
||||
2. Fork this repo by clicking on the fork button on the top of this page.
|
||||
2. Fork this repo by clicking on the fork button on the top of the [project Github][project] page.
|
||||
3. Clone the repository and go to the directory:
|
||||
```sh
|
||||
git clone https://github.com/this-is-you/apparmor.d.git
|
||||
|
|
@ -38,7 +38,7 @@ the useful information needed to contribute.
|
|||
|
||||
`Rule 1: Mandatory Access Control`
|
||||
|
||||
: As these are mandatory access control policies only what it explicitly required
|
||||
: As these are mandatory access control policies only what is explicitly required
|
||||
should be authorized. Meaning, you should **not** allow everything (or a large area)
|
||||
and blacklist some sub areas.
|
||||
|
||||
|
|
@ -93,6 +93,7 @@ profile foo @{exec_path} {
|
|||
|
||||
|
||||
[git]: https://help.github.com/articles/set-up-git/
|
||||
[project]: https://github.com/roddhjav/apparmor.d
|
||||
|
||||
[flags]: https://github.com/roddhjav/apparmor.d/blob/master/dists/flags/main.flags
|
||||
[profiles-a-f]: https://github.com/roddhjav/apparmor.d/blob/master/apparmor.d/profiles-a-f
|
||||
|
|
|
|||
|
|
@ -5,10 +5,10 @@ title: Structure
|
|||
Description of common structure found across various AppArmor profiles
|
||||
|
||||
|
||||
## Program to not confine
|
||||
## Programs to not confine
|
||||
|
||||
Some programs should not be confined by themselves. For example, tools such as
|
||||
`ls`, `rm`, `diff` or `cat` do not have profile in this project. Let's see why.
|
||||
`ls`, `rm`, `diff` or `cat` do not have profiles in this project. Let's see why.
|
||||
|
||||
These are general tools that in a general context can legitimately access any
|
||||
file in the system. Therefore, the confinement of such tools by a global
|
||||
|
|
@ -45,7 +45,7 @@ our profile:
|
|||
profile diff {
|
||||
```
|
||||
|
||||
* In `pass`, as it is a dependency of pass. Here `diff` inherit pass profile
|
||||
* In `pass`, as it is a dependency of pass. Here `diff` inherits pass' profile
|
||||
and has the same access than the pass profile, so it will be allowed to diff
|
||||
password files because more than a generic `diff` it is a `diff` for the pass
|
||||
password manager:
|
||||
|
|
@ -66,8 +66,8 @@ sandbox managed with [Toolbox]
|
|||
|
||||
!!! example "To sum up"
|
||||
|
||||
1. Do not create profile for programs such as: `rm`, `ls`, `diff`, `cd`, `cat`
|
||||
2. Do not create profile for the shell: `bash`, `sh`, `dash`, `zsh`
|
||||
1. Do not a create profile for programs such as: `rm`, `ls`, `diff`, `cd`, `cat`
|
||||
2. Do not a create profile for the shell: `bash`, `sh`, `dash`, `zsh`
|
||||
3. Use [Toolbox].
|
||||
|
||||
[project-rules]: /development/#project-rules
|
||||
|
|
@ -106,9 +106,9 @@ the following note:
|
|||
|
||||
Here is an overview of the current children profile:
|
||||
|
||||
1. **`child-open`**: To opens resources. Instead of allowing the run of all
|
||||
1. **`child-open`**: To open resources. Instead of allowing the run of all
|
||||
software in `/{usr/,}bin/`, the purpose of this profile is to list all GUI
|
||||
program that can open resources. Ultimately, only sandbox manager programs
|
||||
programs that can open resources. Ultimately, only sandbox manager programs
|
||||
such as `bwrap`, `snap`, `flatpak`, `firejail` should be present here. Until
|
||||
this day, this profile will be a controlled mess.
|
||||
|
||||
|
|
@ -124,7 +124,7 @@ Here is an overview of the current children profile:
|
|||
|
||||
See the **[kernel docs][kernel]** to check the major block and char numbers used in `/run/udev/data/`.
|
||||
|
||||
Special care must be given as some as sometime udev numbers are allocated
|
||||
Special care must be given as sometimes udev numbers are allocated
|
||||
dynamically by the kernel. Therefore, the full range must be allowed:
|
||||
|
||||
!!! note ""
|
||||
|
|
|
|||
|
|
@ -10,8 +10,8 @@ Here is an overview of the current CI jobs:
|
|||
|
||||
**On Gitlab CI**
|
||||
|
||||
- Packages build for all supported distribution
|
||||
- Profiles preprocessing verification for all supported distribution
|
||||
- Packages build for all supported distributions
|
||||
- Profiles preprocessing verification for all supported distributions
|
||||
- Go based command linting, coverage, and unit tests
|
||||
|
||||
**On Github Action**
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue