lainos-apparmor

AppArmor profiles for LainOS Layer 02. Enforced security for core daemons, networking, media, crypto, browsers, and system utilities.

Overview

This package ships hardened AppArmor profiles for the full LainOS Layer 02 stack. All profiles are enforced by default at boot via enforce.d symlinks for Protocol 7 daemons.

These profiles were developed iteratively by observing each process's runtime behavior under normal and edge-case workloads, then validated in enforce mode by auditing AppArmor denial logs and refining permissions until only the minimum required access remained. (This was grueling.)

Component	Profile	Status
DNS resolver	usr.bin.dnsmasq	Enforced
Tor daemon	usr.bin.tor	Enforced
DNS-over-TLS	usr.bin.stubby	Enforced
DNSCrypt proxy	usr.bin.dnscrypt-proxy	Enforced
Syslog	usr.bin.syslog-ng	Enforced
Wi-Fi daemon	usr.lib.iwd.iwd	Enforced
DHCP client	usr.bin.dhcpcd	Enforced
NTP client	usr.bin.chronyd	Enforced
Browser	usr.lib.librewolf.librewolf	Enforced
Password Manager	usr.bin.keepasxc	Enforced
Firewall	usr.bin.nft	Enforced
DNS validator	usr.bin.unbound	Enforced
Media server	usr.bin.pipewire	Enforced
Media session	usr.bin.wireplumber	Enforced
Video player	usr.bin.mpv	Enforced
Video player	usr.bin.vlc	Enforced
Password manager	usr.bin.keepassxc	Enforced
GPG	usr.bin.gpg	Enforced
GPG agent	usr.bin.gpg-agent	Enforced
SSH client	usr.bin.ssh	Enforced
SSH server	usr.sbin.sshd	Enforced
Tor bridge	usr.bin.snowflake-pt-client	Enforced
Tor Browser	tor-browser	Enforced (standalone)
Protocol 7 bridge	usr.libexec.lainos.lainos-dbus-bridge	Enforced
Protocol 7 notify	usr.libexec.lainos.lainos-notifyd	Enforced
Protocol 7 init	usr.libexec.lainos.lainos-init	Enforced

Installation

pacman -S lainos-apparmor

Requires apparmor and protocol7-core>=5.5.3-26.

Local Overrides

Site-specific rules go in /etc/apparmor.d/local/ without touching the main profiles. Empty override files are pre-installed for every shipped profile.

Example: allow a custom log path for syslog-ng:

# /etc/apparmor.d/local/usr.bin.syslog-ng
/var/log/custom/ rw,
/var/log/custom/** rw,

Then reload:

apparmor_parser -r /etc/apparmor.d/usr.bin.syslog-ng

Emergency Escape

If a profile breaks the system:

# Complain-mode a single profile
doas aa-complain /etc/apparmor.d/<profile>

# Or use the emergency fix script
doas /usr/local/bin/apparmor-emergency-fix

The emergency script sets all Protocol 7 profiles to complain mode so you can boot and diagnose.

Build

Part of the Protocol 7 repository.

cd lainos-apparmor
makepkg -f

Notes

• syslog-ng uses explicit unix-dgram("/dev/log") on OpenRC instead of system() to avoid systemd auto-detection.
• dnscrypt-proxy supports anonymized DNS routes and HTTPS resolver list downloads via built-in CA trust store.
• gpg and gpg-agent profiles support user keyrings (~/.gnupg/), pacman keyring (/etc/pacman.d/gnupg/), and Tor Browser's isolated GPG homedir (~/.local/share/torbrowser/gnupg_homedir/).
• ssh profile covers client operations including ControlMaster sockets and agent forwarding.
• sshd profile covers key and password auth, PTY allocation, and SFTP subsystem.
• obfs4proxy is not yet tested under enforcement and is not shipped.

Maintainer

Grayson Giles amnesia@lainos.net