Move help and deprecated to their own files
This commit is contained in:
109
arch/base.md
109
arch/base.md
@@ -51,14 +51,6 @@ I have instructions for building a:
|
||||
- [CUPS Printing](#cups-printing)
|
||||
- [Yubikey](#yubikey)
|
||||
- [Bashrc](#bashrc)
|
||||
- [Unecessary](#unecessary)
|
||||
- [Plymouth Background Image](#plymouth-background-image)
|
||||
- [Help](#help)
|
||||
- [Update Grub](#update-grub)
|
||||
- [Downgrading Kernel](#downgrading-kernel)
|
||||
- [Deprecated](#deprecated)
|
||||
- [Deprecated Security](#deprecated-security)
|
||||
- [Firejail](#firejail)
|
||||
|
||||
## Installation
|
||||
|
||||
@@ -762,6 +754,7 @@ AMD
|
||||
|
||||
```bash
|
||||
pacman -S vulkan-radeon libva-utils libva-mesa-driver xf86-video-amdgpu
|
||||
vainfo
|
||||
```
|
||||
|
||||
### Power Management
|
||||
@@ -958,6 +951,8 @@ sudo systemctl enable --now pcscd
|
||||
|
||||
## Bashrc
|
||||
|
||||
Don't do this if you installed `zsh`
|
||||
|
||||
~/.bashrc
|
||||
|
||||
```bash
|
||||
@@ -1050,100 +1045,4 @@ alias lsc='find . -type f | wc -l'
|
||||
|
||||
## ls sort by last modified ##
|
||||
alias lmt='ls -t -1'
|
||||
```
|
||||
|
||||
## Unecessary
|
||||
|
||||
### Plymouth Background Image
|
||||
|
||||
1. `sudo cp image.png /usr/share/plymouth/themes/spinner/background-tile.png`
|
||||
1. `sudo plymouth-set-default-theme -R spinner`
|
||||
|
||||
## Help
|
||||
|
||||
### Update Grub
|
||||
|
||||
1. `grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id=BOOT`
|
||||
1. `cp /boot/EFI/BOOT/grubx64.efi /boot/EFI/BOOT/bootx64.efi`
|
||||
|
||||
### Downgrading Kernel
|
||||
|
||||
You can find old kernel versions at <https://archive.archlinux.org/packages/l/linux/>
|
||||
|
||||
You can find old kernel-header versions at <https://archive.archlinux.org/packages/l/linux-headers/>
|
||||
|
||||
If you want to downgrade to a previously installed kernel you can use pacman cache:
|
||||
|
||||
1. `cd /var/cache/pacman/pkg`
|
||||
2. `pacman -U linux-x.x.x.arch1-1-x86_64.pkg.tar.zst linux-headers-x.x.x.arch1-1-x86_64.pkg.tar.zst`
|
||||
3. `reboot`
|
||||
|
||||
If you want to downgrade to a kernel that wasn't previously installed:
|
||||
|
||||
1. Download linux... and linux-headers... from above
|
||||
2. `pacman -U linux-x.x.x.arch1-1-x86_64.pkg.tar.zst linux-headers-x.x.x.arch1-1-x86_64.pkg.tar.zst`
|
||||
3. `reboot`
|
||||
|
||||
## Deprecated
|
||||
|
||||
### Deprecated Security
|
||||
|
||||
#### Firejail
|
||||
|
||||
Don't use firejail, it's a suid binary which only runs in userspace. Apparmor does
|
||||
almost exactly the same thing but runs in the kernel at boot and protects you more
|
||||
completely. I'm leaving this here in case you're interested but realistically you
|
||||
should just learn apparmor.
|
||||
|
||||
Firejail launches supported applications in a sandboxed environment where it limits access
|
||||
to system files and resources.
|
||||
|
||||
For example:
|
||||
|
||||
- Firefox will not be able to access more than a small subset of your home directory.
|
||||
- VSCode will not be able to acces ~/.config/autostart.
|
||||
|
||||
1. `sudo pacman -S firejail`
|
||||
2. `sudo apparmor_parser -r /etc/apparmor.d/firejail-default`
|
||||
3. `sudo firecfg`
|
||||
4. `firecfg --fix`
|
||||
5. `sudo rm /usr/local/bin/dnsmasq` (this fixes an issue with virsh network start)
|
||||
6. Add a pacman hook to apply firejail on install
|
||||
|
||||
/etc/pacman.d/hooks/firejail.hook
|
||||
|
||||
```conf
|
||||
[Trigger]
|
||||
Type = Path
|
||||
Operation = Install
|
||||
Operation = Upgrade
|
||||
Operation = Remove
|
||||
Target = usr/bin/*
|
||||
Target = usr/share/applications/*.desktop
|
||||
|
||||
[Action]
|
||||
Description = Configure symlinks in /usr/local/bin based on firecfg.config...
|
||||
When = PostTransaction
|
||||
Depends = firejail
|
||||
Exec = /bin/sh -c 'firecfg >/dev/null 2>&1'
|
||||
```
|
||||
|
||||
You can run firejail with noprofile to fix access issues (like firefox gnome connector)
|
||||
|
||||
```bash
|
||||
firejail --noprofile firefox
|
||||
```
|
||||
|
||||
You'll probably want to enable the following
|
||||
|
||||
`sudo cat /etc/firejail/firejail.config | grep -e '^[^#].*'`
|
||||
|
||||
/etc/firejail/firejail.config
|
||||
|
||||
```conf
|
||||
browser-disable-u2f no
|
||||
chroot yes
|
||||
firejail-prompt yes
|
||||
force-nonewprivs yes
|
||||
tracelog yes
|
||||
```
|
||||
```
|
||||
Reference in New Issue
Block a user