dfda66ac7e
Per docs/research/2026-05-05-agent-wave/04-hardening-tier-2.md (v0.6
scope item 1).
Adds:
- apparmor-parser apparmor-utils apparmor-profiles to %packages in
BOTH kickstart/veilor-os.ks (live ks) and overlay/usr/local/bin/
veilor-installer (generated install ks heredoc).
- scripts/40-apparmor.sh — wires aa-complain on every veilor-shipped
profile. Idempotent. "loaded, present, nothing breaks".
- overlay/etc/apparmor.d/veilor.d/firefox — 1-liner stub (binary
confinement marker only; full policy post-v0.6).
- overlay/etc/apparmor.d/veilor.d/thunderbird — same pattern.
- Wired 40-apparmor.sh into install %post chain after
30-apply-v03-theme.sh.
Complain mode means: profiles loaded, kernel logs syscall denials but
does NOT enforce. Operator can review audit.log post-install to
inform v0.7 policy authoring.
|
||
|---|---|---|
| .. | ||
| apparmor.d/veilor.d | ||
| audisp | ||
| audit/plugins.d | ||
| firewalld/zones | ||
| os-release.d | ||
| sddm.conf.d | ||
| skel | ||
| ssh/sshd_config.d | ||
| sudoers.d | ||
| sysctl.d | ||
| systemd/system | ||
| tuned/profiles | ||
| udev/rules.d | ||
| usbguard | ||