Move help and deprecated to their own files

This commit is contained in:
ducoterra
2023-08-31 08:49:57 -04:00
parent 4604be298b
commit 5d9feac36f
4 changed files with 152 additions and 110 deletions

View File

@@ -51,14 +51,6 @@ I have instructions for building a:
- [CUPS Printing](#cups-printing)
- [Yubikey](#yubikey)
- [Bashrc](#bashrc)
- [Unecessary](#unecessary)
- [Plymouth Background Image](#plymouth-background-image)
- [Help](#help)
- [Update Grub](#update-grub)
- [Downgrading Kernel](#downgrading-kernel)
- [Deprecated](#deprecated)
- [Deprecated Security](#deprecated-security)
- [Firejail](#firejail)
## Installation
@@ -762,6 +754,7 @@ AMD
```bash
pacman -S vulkan-radeon libva-utils libva-mesa-driver xf86-video-amdgpu
vainfo
```
### Power Management
@@ -958,6 +951,8 @@ sudo systemctl enable --now pcscd
## Bashrc
Don't do this if you installed `zsh`
~/.bashrc
```bash
@@ -1050,100 +1045,4 @@ alias lsc='find . -type f | wc -l'
## ls sort by last modified ##
alias lmt='ls -t -1'
```
## Unecessary
### Plymouth Background Image
1. `sudo cp image.png /usr/share/plymouth/themes/spinner/background-tile.png`
1. `sudo plymouth-set-default-theme -R spinner`
## Help
### Update Grub
1. `grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id=BOOT`
1. `cp /boot/EFI/BOOT/grubx64.efi /boot/EFI/BOOT/bootx64.efi`
### Downgrading Kernel
You can find old kernel versions at <https://archive.archlinux.org/packages/l/linux/>
You can find old kernel-header versions at <https://archive.archlinux.org/packages/l/linux-headers/>
If you want to downgrade to a previously installed kernel you can use pacman cache:
1. `cd /var/cache/pacman/pkg`
2. `pacman -U linux-x.x.x.arch1-1-x86_64.pkg.tar.zst linux-headers-x.x.x.arch1-1-x86_64.pkg.tar.zst`
3. `reboot`
If you want to downgrade to a kernel that wasn't previously installed:
1. Download linux... and linux-headers... from above
2. `pacman -U linux-x.x.x.arch1-1-x86_64.pkg.tar.zst linux-headers-x.x.x.arch1-1-x86_64.pkg.tar.zst`
3. `reboot`
## Deprecated
### Deprecated Security
#### Firejail
Don't use firejail, it's a suid binary which only runs in userspace. Apparmor does
almost exactly the same thing but runs in the kernel at boot and protects you more
completely. I'm leaving this here in case you're interested but realistically you
should just learn apparmor.
Firejail launches supported applications in a sandboxed environment where it limits access
to system files and resources.
For example:
- Firefox will not be able to access more than a small subset of your home directory.
- VSCode will not be able to acces ~/.config/autostart.
1. `sudo pacman -S firejail`
2. `sudo apparmor_parser -r /etc/apparmor.d/firejail-default`
3. `sudo firecfg`
4. `firecfg --fix`
5. `sudo rm /usr/local/bin/dnsmasq` (this fixes an issue with virsh network start)
6. Add a pacman hook to apply firejail on install
/etc/pacman.d/hooks/firejail.hook
```conf
[Trigger]
Type = Path
Operation = Install
Operation = Upgrade
Operation = Remove
Target = usr/bin/*
Target = usr/share/applications/*.desktop
[Action]
Description = Configure symlinks in /usr/local/bin based on firecfg.config...
When = PostTransaction
Depends = firejail
Exec = /bin/sh -c 'firecfg >/dev/null 2>&1'
```
You can run firejail with noprofile to fix access issues (like firefox gnome connector)
```bash
firejail --noprofile firefox
```
You'll probably want to enable the following
`sudo cat /etc/firejail/firejail.config | grep -e '^[^#].*'`
/etc/firejail/firejail.config
```conf
browser-disable-u2f no
chroot yes
firejail-prompt yes
force-nonewprivs yes
tracelog yes
```
```