Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now

New answers tagged


AppArmor profile for this case is: profile nonetwork /path/to/exec { # Allow all rules... capability, network, mount, remount, umount, pivot_root, ptrace, signal, dbus, unix, file, # ...but no network deny network, deny capability net_admin, deny capability net_bind_service, deny capability net_broadcast, deny capability ...


Not really what you want, but more closer variant is: normal@user:$ aa-exec -p restricted_books booyah In this scenrio you still need: Enabling AppArmor Writing a profile Registering profile But after that you can confine any application with any profile as normal user by aa-exec (confine a program with the specified AppArmor profile). More detail in man ...

Top 50 recent answers are included