Gecko [ www.jobworksschool.com ]

Name	Size	Permission	Date
abi	[ DIR ]	drwxr-xr-x	2026-01-30 23:29
abstractions	[ DIR ]	drwxr-xr-x	2026-01-30 23:29
disable	[ DIR ]	drwxr-xr-x	2025-03-19 18:09
force-complain	[ DIR ]	drwxr-xr-x	2025-03-19 18:09
local	[ DIR ]	drwxr-xr-x	2026-01-30 23:29
rsyslog.d	[ DIR ]	drwxr-xr-x	2026-07-24 06:17
tunables	[ DIR ]	drwxr-xr-x	2026-01-30 23:29
1password	354 B	-rw-r--r--	2025-03-19 18:09
Discord	352 B	-rw-r--r--	2025-03-19 18:09
MongoDB_Compass	386 B	-rw-r--r--	2025-03-19 18:09
QtWebEngineProcess	404 B	-rw-r--r--	2025-03-19 18:09
balena-etcher	374 B	-rw-r--r--	2025-03-19 18:09
brave	348 B	-rw-r--r--	2025-03-19 18:09
buildah	342 B	-rw-r--r--	2025-03-19 18:09
busybox	342 B	-rw-r--r--	2025-03-19 18:09
cam	330 B	-rw-r--r--	2025-03-19 18:09
ch-checkns	351 B	-rw-r--r--	2025-03-19 18:09
ch-run	339 B	-rw-r--r--	2025-03-19 18:09
chrome	349 B	-rw-r--r--	2025-03-19 18:09
code	349 B	-rw-r--r--	2025-03-19 18:09
crun	333 B	-rw-r--r--	2025-03-19 18:09
devhelp	342 B	-rw-r--r--	2025-03-19 18:09
element-desktop	368 B	-rw-r--r--	2025-03-19 18:09
epiphany	356 B	-rw-r--r--	2025-03-19 18:09
evolution	348 B	-rw-r--r--	2025-03-19 18:09
firefox	410 B	-rw-r--r--	2025-03-19 18:09
flatpak	342 B	-rw-r--r--	2025-03-19 18:09
foliate	342 B	-rw-r--r--	2025-03-19 18:09
geary	336 B	-rw-r--r--	2025-03-19 18:09
github-desktop	378 B	-rw-r--r--	2025-03-19 18:09
goldendict	353 B	-rw-r--r--	2025-03-19 18:09
ipa_verify	351 B	-rw-r--r--	2025-03-19 18:09
kchmviewer	353 B	-rw-r--r--	2025-03-19 18:09
keybase	346 B	-rw-r--r--	2025-03-19 18:09
lc-compliance	360 B	-rw-r--r--	2025-03-19 18:09
libcamerify	354 B	-rw-r--r--	2025-03-19 18:09
linux-sandbox	383 B	-rw-r--r--	2025-03-19 18:09
loupe	336 B	-rw-r--r--	2025-03-19 18:09
lsb_release	1.35 KB	-rw-r--r--	2025-03-19 18:09
lxc-attach	351 B	-rw-r--r--	2025-03-19 18:09
lxc-create	351 B	-rw-r--r--	2025-03-19 18:09
lxc-destroy	354 B	-rw-r--r--	2025-03-19 18:09
lxc-execute	354 B	-rw-r--r--	2025-03-19 18:09
lxc-stop	345 B	-rw-r--r--	2025-03-19 18:09
lxc-unshare	354 B	-rw-r--r--	2025-03-19 18:09
lxc-usernsexec	363 B	-rw-r--r--	2025-03-19 18:09
mmdebstrap	351 B	-rw-r--r--	2025-03-19 18:09
msedge	352 B	-rw-r--r--	2025-03-19 18:09
nautilus	346 B	-rw-r--r--	2025-03-19 18:09
notepadqq	402 B	-rw-r--r--	2025-03-19 18:09
nvidia_modprobe	1.18 KB	-rw-r--r--	2025-08-15 12:16
obsidian	350 B	-rw-r--r--	2025-03-19 18:09
opam	333 B	-rw-r--r--	2025-03-19 18:09
opera	355 B	-rw-r--r--	2025-03-19 18:09
pageedit	347 B	-rw-r--r--	2025-03-19 18:09
plasmashell	680 B	-rw-r--r--	2025-03-19 18:09
podman	339 B	-rw-r--r--	2025-03-19 18:09
polypane	350 B	-rw-r--r--	2025-03-19 18:09
privacybrowser	365 B	-rw-r--r--	2025-03-19 18:09
qcam	333 B	-rw-r--r--	2025-03-19 18:09
qmapshack	348 B	-rw-r--r--	2025-03-19 18:09
qutebrowser	354 B	-rw-r--r--	2025-03-19 18:09
rootlesskit	354 B	-rw-r--r--	2025-03-19 18:09
rpm	330 B	-rw-r--r--	2025-03-19 18:09
rssguard	347 B	-rw-r--r--	2025-03-19 18:09
runc	334 B	-rw-r--r--	2025-03-19 18:09
sbuild	339 B	-rw-r--r--	2025-03-19 18:09
sbuild-abort	357 B	-rw-r--r--	2025-03-19 18:09
sbuild-adduser	364 B	-rw-r--r--	2025-03-19 18:09
sbuild-apt	351 B	-rw-r--r--	2025-03-19 18:09
sbuild-checkpackages	381 B	-rw-r--r--	2025-03-19 18:09
sbuild-clean	357 B	-rw-r--r--	2025-03-19 18:09
sbuild-createchroot	378 B	-rw-r--r--	2025-03-19 18:09
sbuild-destroychroot	382 B	-rw-r--r--	2025-03-19 18:09
sbuild-distupgrade	375 B	-rw-r--r--	2025-03-19 18:09
sbuild-hold	354 B	-rw-r--r--	2025-03-19 18:09
sbuild-shell	365 B	-rw-r--r--	2025-03-19 18:09
sbuild-unhold	360 B	-rw-r--r--	2025-03-19 18:09
sbuild-update	360 B	-rw-r--r--	2025-03-19 18:09
sbuild-upgrade	363 B	-rw-r--r--	2025-03-19 18:09
scide	355 B	-rw-r--r--	2025-03-19 18:09
signal-desktop	366 B	-rw-r--r--	2025-03-19 18:09
slack	342 B	-rw-r--r--	2025-03-19 18:09
slirp4netns	354 B	-rw-r--r--	2025-03-19 18:09
steam	363 B	-rw-r--r--	2025-03-19 18:09
stress-ng	348 B	-rw-r--r--	2025-03-19 18:09
surfshark	354 B	-rw-r--r--	2025-03-19 18:09
systemd-coredump	377 B	-rw-r--r--	2025-03-19 18:09
thunderbird	354 B	-rw-r--r--	2025-03-19 18:09
toybox	335 B	-rw-r--r--	2025-03-19 18:09
transmission	2.34 KB	-rw-r--r--	2025-03-19 18:09
trinity	342 B	-rw-r--r--	2025-03-19 18:09
tup	330 B	-rw-r--r--	2025-03-19 18:09
tuxedo-control-center	400 B	-rw-r--r--	2025-03-19 18:09
ubuntu_pro_apt_news	2.02 KB	-rw-r--r--	2025-10-27 12:42
ubuntu_pro_esm_cache	7.05 KB	-rw-r--r--	2026-07-06 13:28
unix-chkpwd	881 B	-rw-r--r--	2025-03-19 18:09
unprivileged_userns	699 B	-rw-r--r--	2025-03-19 18:09
userbindmount	360 B	-rw-r--r--	2025-03-19 18:09
usr.bin.man	3.37 KB	-rw-r--r--	2025-08-05 17:14
usr.bin.tcpdump	1.65 KB	-rw-r--r--	2025-08-05 17:14
usr.lib.snapd.snap-confine.real	30.96 KB	-rw-r--r--	2026-07-13 14:38
usr.sbin.mysqld	1.96 KB	-rw-r--r--	2025-08-19 14:30
usr.sbin.rsyslogd	1.83 KB	-rw-r--r--	2026-03-10 15:59
uwsgi-core	351 B	-rw-r--r--	2025-03-19 18:09
vdens	336 B	-rw-r--r--	2025-03-19 18:09
virtiofsd	352 B	-rw-r--r--	2025-03-19 18:09
vivaldi-bin	358 B	-rw-r--r--	2025-03-19 18:09
vpnns	336 B	-rw-r--r--	2025-03-19 18:09
wike	333 B	-rw-r--r--	2024-04-12 03:59
wpcom	346 B	-rw-r--r--	2025-03-19 18:09

Rename

# vim:syntax=apparmor

#include <tunables/global>

/usr/bin/man {
  #include <abstractions/base>

# Use a special profile when man calls anything groff-related.  We only
  # include the programs that actually parse input data in a non-trivial
  # way, not wrappers such as groff and nroff, since the latter would need a
  # broader profile.
  /usr/bin/eqn rmCx -> &man_groff,
  /usr/bin/grap rmCx -> &man_groff,
  /usr/bin/pic rmCx -> &man_groff,
  /usr/bin/preconv rmCx -> &man_groff,
  /usr/bin/refer rmCx -> &man_groff,
  /usr/bin/tbl rmCx -> &man_groff,
  /usr/bin/troff rmCx -> &man_groff,
  /usr/bin/vgrind rmCx -> &man_groff,

# Similarly, use a special profile when man calls decompressors and other
  # simple filters.
  /{,usr/}bin/bzip2 rmCx -> &man_filter,
  /{,usr/}bin/gzip rmCx -> &man_filter,
  /usr/bin/col rmCx -> &man_filter,
  /usr/bin/compress rmCx -> &man_filter,
  /usr/bin/iconv rmCx -> &man_filter,
  /usr/bin/lzip.lzip rmCx -> &man_filter,
  /usr/bin/tr rmCx -> &man_filter,
  /usr/bin/xz rmCx -> &man_filter,

# Allow basically anything in terms of file system access, subject to DAC.
  # The purpose of this profile isn't to confine man itself (that might be
  # nice in the future, but is tricky since it's quite configurable), but to
  # confine the processes it calls that parse untrusted data.
  /** mrixwlk,
  unix,

capability setuid,
  capability setgid,

# Ordinary permission checks sometimes involve checking whether the
  # process has this capability, which can produce audit log messages.
  # Silence them.
  deny capability dac_override,
  deny capability dac_read_search,

signal peer=@{profile_name},
  signal peer=/usr/bin/man//&man_groff,
  signal peer=/usr/bin/man//&man_filter,

# Site-specific additions and overrides.  See local/README for details.
  #include <local/usr.bin.man>
}

profile man_groff {
  #include <abstractions/base>
  # Recent kernels revalidate open FDs, and there are often some still
  # open on TTYs.  This is temporary until man learns to close irrelevant
  # open FDs before execve.
  #include <abstractions/consoles>
  # man always runs its groff pipeline with the input file open on stdin,
  # so we can skip <abstractions/user-manpages>.

/usr/bin/eqn rm,
  /usr/bin/grap rm,
  /usr/bin/pic rm,
  /usr/bin/preconv rm,
  /usr/bin/refer rm,
  /usr/bin/tbl rm,
  /usr/bin/troff rm,
  /usr/bin/vgrind rm,

/etc/groff/** r,
  /etc/papersize r,
  /usr/lib/groff/site-tmac/** r,
  /usr/share/groff/** r,

/tmp/groff* rw,

signal peer=/usr/bin/man,
  # @{profile_name} doesn't seem to work here.
  signal peer=/usr/bin/man//&man_groff,
}

profile man_filter {
  #include <abstractions/base>
  # Recent kernels revalidate open FDs, and there are often some still
  # open on TTYs.  This is temporary until man learns to close irrelevant
  # open FDs before execve.
  #include <abstractions/consoles>

/{,usr/}bin/bzip2 rm,
  /{,usr/}bin/gzip rm,
  /usr/bin/col rm,
  /usr/bin/compress rm,
  /usr/bin/iconv rm,
  /usr/bin/lzip.lzip rm,
  /usr/bin/tr rm,
  /usr/bin/xz rm,

# Manual pages can be more or less anywhere, especially with "man -l", and
  # there's no harm in allowing wide read access here since the worst it can
  # do is feed data to the invoking man process.
  /** r,

# Allow writing cat pages.
  /var/cache/man/** w,

signal peer=/usr/bin/man,
  # @{profile_name} doesn't seem to work here.
  signal peer=/usr/bin/man//&man_filter,
}