Can attacker break out of apparmor jail with the following profile?

Question

Below is an example profile I've created for web apps, in which I've limited files / commands it can access. It includes profiles to nginx, php-fpm and mysql, no commands is allowed, only few directories / files for read / write / flock access, and network socket.

(The rest is located in my github repository)

/usr/bin/php-fpm {
  #include <abstractions/base>

  capability chown,
  capability kill,
  capability setgid,
  capability setuid,

  # Suppress the "DENY" error logs
  deny /usr/bin/bash x,

  /etc/php/** r,
  /run/php-fpm/ r,
  /run/php-fpm/php-fpm.* w,
  /usr/bin/php-fpm mr,
  /usr/lib/php/modules/* mr,

  /var/html/{**,} r,

  # logs
  /var/log/ r,
  /var/log/php*.log w,

  # Web folders that need write access
  /var/html/icy/{cache,logs,files,images,downloads}/{**,} rwk,
}

Right now I believe after a successfuly remote exploit, the attacker can only affect the web app folder, and can't compromise the system further,

So my question is, is there still a chance for the attacker to break out of this?

And how?

Answer 1

Of course. Your profile (And NO apparmor profile) does nothing to limit kernel attack surface. An attacker can exploit the kernel, unhook apparmor, and be out.

only few directories / files for read / write / flock access, and network socket.

Notice that ? That's adding hundreds more files to your profile. While your profile may look quite tight, it is in fact allowing quite a lot of access.

That said, no massive issues stick out. No UX, no write access to really critical stuff. Those capabilities suck though - you sure they're necessary? Probably are.