Amir Alexander Abdelbaki 87b62f368b feat(ansipa): rework binary blocking as per-user policy; add local_sudo device policy ... policy-block-binary-<name> is now a FreeIPA *user* group instead of a host group, so restrictions follow the user to every enrolled machine. The PATH wrapper is installed on all hosts and checks group membership at runtime via id(1)/SSSD, passing non-members through transparently. __ in the group name decodes to . so Flatpak app IDs are supported (flatpak run fallback included). AppArmor layer removed since per-user confinement requires a different approach and the wrapper alone is sufficient. Adds local_sudo_<username> host group policy which writes a sudoers drop-in granting that user full sudo on the specific device, reverted on group leave. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>		2026-05-20 16:31:43 +02:00
..
ansible	feat(ansipa): rework binary blocking as per-user policy; add local_sudo device policy	2026-05-20 16:31:43 +02:00
image	feat(ansipa): store LUKS backup keys on SMB share with KeyAdmin access control	2026-05-20 15:33:17 +02:00
auto-enroll-ansible.sh	Update setup/modules/FreeipaAnsible/auto-enroll-ansible.sh	2026-04-27 16:38:02 +02:00
copilot-explains.txt	Update setup/modules/FreeipaAnsible/copilot-explains.txt	2026-04-27 17:00:37 +02:00
freeipa-client-answerfile.json	setup: add FreeIPA server module and generic client script	2026-05-18 11:12:31 +02:00
freeipa-client.sh	setup: add FreeIPA server module and generic client script	2026-05-18 11:12:31 +02:00
freeipa-enroll.sh	Update setup/modules/FreeipaAnsible/freeipa-enroll.sh	2026-04-27 16:37:09 +02:00