For purposes of setting up AppArmor or SE Linux, I'm looking to audit what files a program could possibly need access to.
My understanding is that the end of AppArmor or SE Linux, is to constrain processes to a set of files they are allowed to read, create or modify to make sure a process isn't going outside of its set boundaries; which from a security standpoint would seem to indicate that a server has been compromised.
I found a tutorial which uses
strace to determine which files are being used by a process.
It seems as though this could become a difficult thing to determine when you consider things like:
- temp file names
- Process Hierarchy
- Database temp tables
- Program plugins
Is there anything else I need to take into account when trying to determine which files a program accesses?
Also, are there any pre created repositories that might include settings for setting up the security of such things?