apparmor.d -> profiles

profiles/pam_roles

@@ -0,0 +1,59 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2019-2021 Mikhail Morfikov
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+#
+# See more at: https://gitlab.com/apparmor/apparmor/wikis/Pam_apparmor_example
+
+#
+# This file contains the roles as referenced by pam/mappings
+#
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+# By default, allow users to read, lock and link to their own files anywhere,
+# but only write to files in their home directory. Only allow limited execution
+# of files.
+profile default_user flags=(complain) {
+  include <abstractions/base>
+  include <abstractions/bash>
+  include <abstractions/consoles>
+  include <abstractions/nameservice>
+
+  deny capability sys_ptrace,
+
+  /{usr/,}bin/**  Pixmr,
+
+  owner /** rkl,
+  @{PROC}/** r,
+
+  owner @{HOMEDIRS}/ w,
+  owner @{HOMEDIRS}/** w,
+
+}
+
+# Allow confined_users to read, write, lock and link to their own files
+# anywhere, and execute from some places.
+profile confined_user flags=(complain) {
+  include <abstractions/base>
+  include <abstractions/bash>
+  include <abstractions/consoles>
+  include <abstractions/nameservice>
+
+  deny capability sys_ptrace,
+
+  /{usr/,}bin/**  Pixmr,
+  owner @{HOMEDIRS}/bin/** ixmr,
+
+  owner /** rwkl,
+  @{PROC}/** r,
+
+}