jack-ullery
commented
12 months ago Maybe this should be reserved for another issue, but we should also consider things like DENY rules. Currently, these are shown in the same table as ALLOW rules which may be confusing.
Also, we need to add the ability to add/delete rules from a profile. This is especially noticeable in the abstractions section.
Is your feature request related to a problem? Please describe. The goal of the 'Modify Profile' page is to allow users to visualize and configure the permissions for individual profiles on their system. Currently, the page shows information about abstractions and file rules. However, no changes are actually saved to a profile.
Describe the solution you'd like When the user makes a change to a profile, it should either: save the change immediately and update the profile (allowing the user to undo the change), or have an apply/save button that triggers the update. This update would prompt the user through pkexec.
Additional context One reason why this has taken a while, is that performing these actions require super-user permissions. For previous issues, we have used pkexec to call aa-caller when prompting the user for permission, but that would be difficult here, because we want the permission to write an arbitrary string to a file. This would be a little annoying to do through aa-caller, even if it is our best approach.