Search Results
| Search type | Search syntax |
|---|---|
| Tags | [tag] |
| Exact | "words here" |
| Author |
user:1234 user:me (yours) |
| Score |
score:3 (3+) score:0 (none) |
| Answers |
answers:3 (3+) answers:0 (none) isaccepted:yes hasaccepted:no inquestion:1234 |
| Views | views:250 |
| Code | code:"if (foo != bar)" |
| Sections |
title:apples body:"apples oranges" |
| URL | url:"*.example.com" |
| Saves | in:saves |
| Status |
closed:yes duplicate:no migrated:no wiki:no |
| Types |
is:question is:answer |
| Exclude |
-[tag] -apples |
| For more details on advanced search visit our help page | |
Results tagged with apparmor
Search options answers only
not deleted
user 219967
A filesystem-independent Linux kernel security module enabling Mandatory Access Control (MAC).
6
votes
Accepted
Apparmor - how to 'allow everything' rule, then tighten up?
/path/to/exec {
# Allow all rules
capability,
network,
mount,
remount,
umount,
pivot_root,
ptrace,
signal,
dbus,
unix,
file,
}
Actually, there are two rules more:
rlimit (AppArmor …
- 96
1
vote
Restrict network access for a single process with SELinux or AppArmor
AppArmor profile for this case is:
profile nonetwork /path/to/exec {
# Allow all rules... …
- 96
1
vote
Opt-in a security profile at runtime, without tedious setup
Not really what you want, but more closer variant is:
normal@user:$ aa-exec -p restricted_books booyah
In this scenrio you still need:
Enabling AppArmor
Writing a profile
Registering profile
But … after that you can confine any application with any profile as normal user by aa-exec (confine a program with the specified AppArmor profile). …
- 96