Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Can anyone possibly explain why Apparmor is not picking up profiles for sub-processes of a process? Right now we use God to launch an unstoppable Ruby process (in this case it's /usr/local/bin/remote) it needs to have quite a few of the privileges afforded to God removed (such as access to /etc/passwd) but it seems Apparmor doesn't like the idea of applying profiles to sub-processes, to test I created a profile for each possibility:

-rw-r--r--  1 root root  194 Feb 10 15:36 usr.bin.ruby
-rw-r--r--  1 root root  199 Feb 10 15:36 usr.bin.ruby1.9.1
-rw-r--r--  1 root root  199 Feb 10 15:36 usr.bin.ruby1.9.3
-rw-r--r--  1 root root  837 Feb 10 15:38 usr.local.bin.god
-rw-r--r--  1 root root  206 Feb 10 15:37 usr.local.bin.remote

God launches a process with ruby /usr/local/bin/remote ruby has deny /etc/passwd r, so does ruby1.9.3, ruby1.9.1 and /usr/local/bin/remote however upon connecting to the remote, it's only picked up the rules from God. Fair enough perhaps I misread the docs after I double checked.

So my questions are:

  1. Is there a proper way to allow for a root process only?
  2. Is there a proper way to deny for a sub-process since profile * { } fails.
  3. Can anyone explain why Apparmor is not applying profiles to the sub-process?
share|improve this question

closed as off topic by Rory Alsop Apr 27 '12 at 18:01

Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.