feat(profiles): remove unused user role & mappings

- Not enabled, tested.
- Will come back under another form later.
This commit is contained in:
Alexandre Pujol 2025-01-15 00:08:43 +01:00
parent ba067a0214
commit d20435eb21
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
4 changed files with 0 additions and 160 deletions

View file

@ -1,31 +0,0 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# Allow confined users to read, write, lock and link to their own files
# anywhere, and execute from some places.
abi <abi/4.0>,
include <tunables/global>
profile user_confined flags=(complain) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
include <abstractions/shells>
deny capability sys_ptrace,
@{bin}/** Pixmr,
owner /** rwkl,
owner @{HOMEDIRS}/bin/** ixmr,
owner @{user_bin_dirs}/** ixmr,
@{PROC}/** r,
include if exists <local/user_confined>
}
# vim:syntax=apparmor

View file

@ -1,32 +0,0 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# By default, allow users to read, lock and link to their own files anywhere,
# but only write to files in their home directory. Only allow limited execution
# of files.
abi <abi/4.0>,
include <tunables/global>
profile user_default flags=(complain) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
include <abstractions/shells>
deny capability sys_ptrace,
@{bin}/** Pixmr,
owner /** rkl,
owner @{HOMEDIRS}/ w,
owner @{HOMEDIRS}/** w,
@{PROC}/** r,
include if exists <local/user_default>
}
# vim:syntax=apparmor

View file

@ -1,25 +0,0 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
profile user_unconfined flags=(attach_disconnected,mediate_deleted) {
capability,
network,
mount,
remount,
umount,
pivot_root,
ptrace,
signal,
dbus,
unix,
file,
include if exists <local/user_unconfined>
}
# vim:syntax=apparmor