AppArmor profiles for various programs and services on Arch Linux.
Table of contents:
These AppArmor profiles are tested on the following hardware:
I cannot guarantee that these profiles will work on any other hardware. All profiles should work with Sway on AMD and Intel hardware. At this time I no longer have access to NVIDIA hardware nor the desire to maintain support for their proprietary driver.
These profiles strive to be fully functional with zero audit log warnings under normal usage. Functionality is not ignored. If functionality is not explicitly blocked, then it's probably a bug in the profile and should be fixed. Create an issue: https://github.com/krathalan/apparmor-profiles/issues
You should read through the notes before using these profiles.
Get krathalans-apparmor-profiles-git
from the AUR: https://aur.archlinux.org/packages/krathalans-apparmor-profiles-git/
To add rules to the profiles without changing the files provided by this repository, use local overrides. See less /etc/apparmor.d/local/README
for more details. You can see commented examples of local overrides in the local/
directory in this repository.
Please file bug reports, requests, etc. at https://github.com/krathalan/apparmor-profiles/issues
Writing AppArmor profiles is fairly easy. "If you know how to use bash, chmod, and grep, you already understand AppArmor and you can probably reverse-engineer the policy by yourself," at 13:25 in the video: https://invidio.us/watch?v=k3kerBRYLhw
Pull requests and issues are welcome. I cannot test for hardware I do not have access to (AMD), so those PRs would be most critical.
To get started writing AppArmor profiles, I highly recommend this video from openSUSE: https://invidio.us/watch?v=o2xa8JYcrmw
You may also find this document incredibly helpful: https://gitlab.com/apparmor/apparmor/wikis/AppArmor_Core_Policy_Reference
If you use a program like GNU stow
to manage your dotfiles via symlinks, you may run in to issues using these AppArmor profiles. You will need to add local overrides to allow that program to access the real location of your config file(s) that the symlink(s) point to. For example, I keep my dotfiles at ~/documents/config/...
and use stow
to keep them in ~/.config
. For the polybar profile, I have the file /etc/apparmor/local/polybar
with the following snippet:
# Config file at ~/.config/polybar/config is a symlink to this file
owner @{HOME}/documents/config/xorg-config/.config/polybar/config r,
See adding local overrides for more information.
The only directory (apart from program-specific config or data directories, such as those in ~/.config
) in the home directory that these profiles are allowed to read and write to is ~/{D,d}ownloads/
. You won't be able to, for example, upload things to the web from your ~/Documents
directory. You'll need to copy the file to your ~/{D,d}ownloads/
directory first, or add local overrides.
You can find more information for the specific profile by clicking on its name. You may not have to add any local overrides, however -- many profiles work with the default configurations for that program.
This profile has been tested with the ungoogled-chromium
AUR package ONLY, on both Xorg and Sway (with --ozone-platform-hint=auto
).
You will need to add local overrides if you wish to view documents that are not in ~/{D,d}ocuments/
or ~/{D,d}ownloads/
. You will also need to add overrides if you wish to edit or save documents.
This profile has been tested with the firefox
and firefox-developer-edition
repo packages, on WebRender -- on the aforementioned hardware, on both Xorg and Sway. This single profile will apply to all Firefox versions.
You will need to add local overrides if you wish to view images that are not in ~/{D,d}ownloads/
, ~/{P,p}ictures/
, or ~/{P,p}hotos/
.
You may need to add local overrides to allow khard
to access your contact storage directory, if you keep it somewhere other than ~/.local/share/contacts
.
You may need to add local overrides to allow mbsync
to access your mail storage directories, if they're somewhere other than ~/.local/share/mail/
.
Additionally, you may add local overrides to be able to view/edit files in directories other than ~/{D,d}ocuments/
and ~/{G,g}it/
.
This profile allows mpv to utilize yt-dlp
to stream videos.
This AppArmor profile also works when mpv is invoked by other programs like streamlink. A streamlink profile is also available.
Use the command line flag --gpu-context=wayland
for Wayland support. Use the command line flag --hwdec=auto
for hardware decoding. You can also tell mpv
to always use these options through a config file.
You will need to add local overrides to allow nginx
to access your hosted files (e.g. index.html
, etc.).
You may need to add local overrides to allow nginx
to access your HTTPS certificates, if you keep them somewhere other than /etc/letsencrypt/
.
This profile assumes you are running nginx
as an unprivileged user via systemd: https://wiki.archlinux.org/index.php/Nginx#Running_unprivileged_using_systemd
You may need to add local overrides to allow pash
to access your password files and GNUPG files if they're somewhere other than ~/.local/share/pash/
and ~/.gnupg/
respectively.
You may need to add local overrides to allow postfix
to access your HTTPS certificates, if you keep them somewhere other than /etc/letsencrypt/
.
These profiles may not work depending on your configuration. Patches accepted.
You may need to add local overrides to allow radicale
to access your:
htpasswd
file, if you keep it somewhere other than /etc/radicale/
./var/lib/radicale/
./etc/letsencrypt/
.Make sure you check the user/group permissions on your htpasswd
file!
This profile will work with mosh
, the mobile shell, and with git
for interacting with remote repositories. There's an AppArmor profile for mosh
in this repository, and these profiles work together.
You may need to add local overrides to allow ssh
to access your SSH keys, if you keep them somewhere other than ~/.ssh/
.
You may need to add local overrides to allow ssh-agent
access to your SSH keys, if you keep them somewhere other than ~/.ssh/
.
You will need to set either mpv
or vlc
as your default player. You must have the separate mpv
AppArmor profile from this repository enabled.
You may need to add local overrides to allow swaybg
to access your specified wallpaper, if you keep it somewhere other than ~/{P,p}ictures/{W,w}allpapers/
.
You will need to add local overrides to allow syncthing
to access your synced directories.
This profile applies to all transmission-*
binaries, including transmission-daemon
and transmission-remote
.
You may need to add local overrides to allow vdirsyncer
to access your contact storage directory, if you keep it somewhere other than ~/.local/share/contacts
.
You may need to add local overrides to allow waybar
modules to work which I have not tested. I have tested the following modules to work: sway/workspaces, sway/mode, sway/window, network, pulseaudio, cpu, clock, tray.
These are profiles which I used to keep updated with their packaged versions, but now do not -- most likely because:
If you wish to maintain one of these profiles please submit patches!
Sometimes I will resurrect these profiles if I see fit (in the case of pipewire).