dfda66ac7e
Per docs/research/2026-05-05-agent-wave/04-hardening-tier-2.md (v0.6
scope item 1).
Adds:
- apparmor-parser apparmor-utils apparmor-profiles to %packages in
BOTH kickstart/veilor-os.ks (live ks) and overlay/usr/local/bin/
veilor-installer (generated install ks heredoc).
- scripts/40-apparmor.sh — wires aa-complain on every veilor-shipped
profile. Idempotent. "loaded, present, nothing breaks".
- overlay/etc/apparmor.d/veilor.d/firefox — 1-liner stub (binary
confinement marker only; full policy post-v0.6).
- overlay/etc/apparmor.d/veilor.d/thunderbird — same pattern.
- Wired 40-apparmor.sh into install %post chain after
30-apply-v03-theme.sh.
Complain mode means: profiles loaded, kernel logs syscall denials but
does NOT enforce. Operator can review audit.log post-install to
inform v0.7 policy authoring.
|
||
|---|---|---|
| .. | ||
| apparmor | ||
| selinux | ||
| 10-harden-base.sh | ||
| 20-harden-kernel.sh | ||
| 30-apply-v03-theme.sh | ||
| 40-apparmor.sh | ||
| firstboot.sh | ||
| kde-theme-apply.sh | ||