Can anyone possibly explain why Apparmor is not picking up profiles for sub-processes of a process? Right now we use God to launch an unstoppable Ruby process (in this case it's /usr/local/bin/remote) it needs to have quite a few of the privileges afforded to God removed (such as access to /etc/passwd) but it seems Apparmor doesn't like the idea of applying profiles to sub-processes, to test I created a profile for each possibility:
-rw-r--r-- 1 root root 194 Feb 10 15:36 usr.bin.ruby
-rw-r--r-- 1 root root 199 Feb 10 15:36 usr.bin.ruby1.9.1
-rw-r--r-- 1 root root 199 Feb 10 15:36 usr.bin.ruby1.9.3
-rw-r--r-- 1 root root 837 Feb 10 15:38 usr.local.bin.god
-rw-r--r-- 1 root root 206 Feb 10 15:37 usr.local.bin.remote
God launches a process with ruby /usr/local/bin/remote ruby has deny /etc/passwd r, so does ruby1.9.3, ruby1.9.1 and /usr/local/bin/remote however upon connecting to the remote, it's only picked up the rules from God. Fair enough perhaps I misread the docs after I double checked.
So my questions are:
- Is there a proper way to allow for a root process only?
- Is there a proper way to deny for a sub-process since profile * { } fails.
- Can anyone explain why Apparmor is not applying profiles to the sub-process?
