s8n d76597c57a sec: AppArmor v0.6 stub — load profiles in complain mode ... Per docs/research/2026-05-05-agent-wave/04-hardening-tier-2.md (v0.6 scope item 1). Adds: - apparmor-parser apparmor-utils apparmor-profiles to %packages in BOTH kickstart/veilor-os.ks (live ks) and overlay/usr/local/bin/ veilor-installer (generated install ks heredoc). - scripts/40-apparmor.sh — wires aa-complain on every veilor-shipped profile. Idempotent. "loaded, present, nothing breaks". - overlay/etc/apparmor.d/veilor.d/firefox — 1-liner stub (binary confinement marker only; full policy post-v0.6). - overlay/etc/apparmor.d/veilor.d/thunderbird — same pattern. - Wired 40-apparmor.sh into install %post chain after 30-apply-v03-theme.sh. Complain mode means: profiles loaded, kernel logs syscall denials but does NOT enforce. Operator can review audit.log post-install to inform v0.7 policy authoring.		2026-05-06 16:10:03 +01:00
..
install-ostreecontainer.ks	v0.7 spike: BlueBuild recipe + ostreecontainer kickstart + cosign workflow	2026-05-05 15:30:04 +01:00
veilor-os.ks	sec: AppArmor v0.6 stub — load profiles in complain mode	2026-05-06 16:10:03 +01:00