AppArmor boolean RFC

apparmor.d/profiles-s-z/yara

@@ -0,0 +1,30 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Zane Zakraisek <[email protected]>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/4.0>,
+
+include <tunables/global>
+include <tunables/booleans>
+
+@{exec_path} = {/usr,}/bin/yara
+profile yara @{exec_path} {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  capability dac_override dac_read_search,
+
+  if $ANTIVIRUS_CAN_PTRACE {
+    ptrace (read, trace),
+    capability sys_ptrace,
+  }
+
+  /{,**} r,
+
+  deny capability sys_admin,
+
+  include if exists <local/yara>
+}
+
+# vim:syntax=apparmor

apparmor.d/tunables/booleans

@@ -0,0 +1,9 @@
+##################################################
+# Allows AV programs to scan memory using ptrace
+# functionality.
+#
+# This grants read and trace permissions.
+#
+# Default: false
+##################################################
+$ANTIVIRUS_CAN_PTRACE = false