Amir Alexander Abdelbaki
fb8ca498ef
Binary blocking now applies two layers: 1. PATH-priority wrapper in /usr/local/bin/ (existing) 2. Empty AppArmor profile in /etc/apparmor.d/ loaded in enforce mode An empty AppArmor profile denies all access — the blocked binary cannot load shared libraries and exits immediately with a permission error, covering callers that use absolute paths and bypassed the wrapper. AppArmor layer is skipped silently when apparmor_parser is not present, and deferred with a warning if the real binary is not yet installed. Profiles are unloaded and deleted when the host leaves the policy group. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| ansible | ||
| image | ||
| auto-enroll-ansible.sh | ||
| copilot-explains.txt | ||
| freeipa-client-answerfile.json | ||
| freeipa-client.sh | ||
| freeipa-enroll.sh | ||