Amir Alexander Abdelbaki
fb8ca498ef
Binary blocking now applies two layers: 1. PATH-priority wrapper in /usr/local/bin/ (existing) 2. Empty AppArmor profile in /etc/apparmor.d/ loaded in enforce mode An empty AppArmor profile denies all access — the blocked binary cannot load shared libraries and exits immediately with a permission error, covering callers that use absolute paths and bypassed the wrapper. AppArmor layer is skipped silently when apparmor_parser is not present, and deferred with a warning if the real binary is not yet installed. Profiles are unloaded and deleted when the host leaves the policy group. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| Setup-shell-4-containers | ||
| archiso | ||
| deprecated | ||
| modules | ||
| arch-autoinstall.sh | ||
| archbaseos-guided-install.sh | ||
| audit-packages.sh | ||
| generate-answerfile.sh | ||
| install-modules.sh | ||
| install.sh | ||
| tui-install.sh | ||