{"id":17145995,"url":"https://github.com/foxcpp/apparmor-profiles","last_synced_at":"2026-03-06T14:34:09.979Z","repository":{"id":98732766,"uuid":"127311684","full_name":"foxcpp/apparmor-profiles","owner":"foxcpp","description":"Random strict AppArmor profiles","archived":false,"fork":false,"pushed_at":"2020-06-18T11:48:06.000Z","size":44,"stargazers_count":6,"open_issues_count":0,"forks_count":3,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-04-10T12:02:55.730Z","etag":null,"topics":["apparmor","apparmor-profile"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/foxcpp.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-03-29T15:33:26.000Z","updated_at":"2024-10-10T18:09:32.000Z","dependencies_parsed_at":"2023-05-25T00:45:27.972Z","dependency_job_id":null,"html_url":"https://github.com/foxcpp/apparmor-profiles","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/foxcpp/apparmor-profiles","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/foxcpp%2Fapparmor-profiles","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/foxcpp%2Fapparmor-profiles/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/foxcpp%2Fapparmor-profiles/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/foxcpp%2Fapparmor-profiles/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/foxcpp","download_url":"https://codeload.github.com/foxcpp/apparmor-profiles/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/foxcpp%2Fapparmor-profiles/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30180720,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-06T12:39:21.703Z","status":"ssl_error","status_checked_at":"2026-03-06T12:36:09.819Z","response_time":250,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["apparmor","apparmor-profile"],"created_at":"2024-10-14T21:07:32.368Z","updated_at":"2026-03-06T14:34:09.898Z","avatar_url":"https://github.com/foxcpp.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"fox.cpp's AppArmor profiles\n==============================\n\nVulnerabilities are everywhere and we have to deal with this mess. AppArmor\nallows to enforce the principle of least privilege for each program you have to\nrun. This way it is possible to significantly reduce the possible impact of\nsecurity breaches.\n\n\nDisclaimer\n--------------\n\nI wrote all profiles for my system (currently Arch Linux, Debian sid in past).\nThey may not work for your system. But... People publish things on GitHub to\nmake them accessible and usable by anyone, right? If something got broken on\nyour system and this problem is caused by my profile - please, open issue and I\nwill try to fix it.\n\nBroken functionality\n------------------------\n\nI'm one of these people who often prefer security over usability. While it's\neasy to cover all use cases for small applications like PDF viewer or IRC\nclient, it's nearly impossible to enumerate everything you may do with\nbloatware like Firefox.  Also, if I will try to make sure every piece of code in\nFirefox gets access to required resources it will open pretty big attack\nsurface. I don't want this.\n\n**Note 1:** I made some restictions optional, always take a look at matching file\nin `local/` if you think something important (like sound) is broken.\n\n**Note 2:** This repository contains modified default \"abstractions\"\n(`abstractions/gnome` and `abstractions/kde`), this may break other profiles.\n\nHow to use\n--------------\n\n1. Make sure `CONFIG_SECURITY_APPARMOR` is enabled in kernel configuration.\n   This is default on Debian, Ubuntu and Arch Linux.\n\n   You can use this command to check:\n   ```\n   zcat /proc/config.gz | grep \"CONFIG_SECURITY_APPARMOR\"\n   ```\n\n2. Add `apparmor=1 security=apparmor` to kernel command line.\n   Depends on bootloader you use, check `/etc/default/grub` if you are using GRUB.\n\n3. Install userspace AppArmor utilities.\n   Package `apparmor` in Debian, Ubuntu, Arch linux.\n\n4. Run `aa-status`. It should say \"apparmor module is loaded\".\n   If it doesn't - make sure you updated bootloader configuration \n   (`grub-update`, `grub-mkconfig` probably) and reboot.\n\n5. Copy contents of `profiles/` to `/etc/apparmor.d`.\n\n6. Tweak files contained in local/ subdirectory (you probably don't want to\n   skip it, default is very restrictive).\n\n6. Load all AppArmor profiles\n```\nsystemctl enable apparmor\nsystemctl start apparmor\n```\n\nCustomization\n--------------\n\nEach system is different. Each user is different. You may want to allow more\nthan my profile allows. To do so, you need to add AppArmor rules to matching\nfile in `local/`. For example, to allow Firefox to access Downloads directory,\nyou need to edit `local/usr.lib.firefox.firefox` and uncomment mentioned\ninclude statement.\n\n\nServer profiles\n--------------\n\nI also have a set of profiles I use on my servers to sandbox stuff. It is in\nserver_profiles/.\n\nLicense\n--------------\n\nProfiles I created from scratch are published under the MIT license.\nModified profiles from Ubuntu are published under the GNU Public License Version 2.\nCheck comments at beggining of each file if you care.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffoxcpp%2Fapparmor-profiles","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffoxcpp%2Fapparmor-profiles","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffoxcpp%2Fapparmor-profiles/lists"}