Can a badly configured AppArmor profile reduce security?

Question

Can a badly or even maliciously configured AppArmor profile reduce security, or can it only improve it? I read that apparently AppArmor cannot override unix file permissions, so it shouldn't give a user more read-write-execute permissions than those they already have, but I'm not completely sure of this. I'm also not sure what a profile can do with all other options, including maybe less known options. So I wonder if an AppArmor profile can only add restrictions and therefore always increase security of an application (maybe even at the expense of usability), or if it can also make the application less secure than it would be by default, maybe giving it more privileges than it should have. The answer to this question might help me to understand if I can trust profiles written by others, or trust myself while I'm learning to write profiles.

Note: I found this related question ( Can too restrictive Linux MAC policy decrease security? ) that partly answers my question, although I wouldn't consider it an exact duplicate because what I'm asking seems a bit more general.

Answer 1

You are asking, whether maliciously or very badly written AppArmor profile can reduce security. Considering this question already states, that you can indeed reduce security using restrictive MAC, using restrictive AppArmor can obviously also decrease security in all the same ways, possible in some additional new ways as well. So YES, it indeed can decrease security.

As for giving processes additional permissions, I am reasonably certain it can't. Unix permissions (DAC) are checked separately before MAC, so it should be impossible to override them.