[apparmor] Apparmor : Common Query

[Murali Selvaraj]

Hi All,

Please see below two queries and share your valuable inputs.

*Question 1: *

I am trying to generate an Apparmor profile similar to the below pseudo
script.

*foo.sh*
#!/bin/sh
if condition
   /bin/sh script_1.sh
fi
/bin/sh script_2.sh
while [ condition ]
do
   if [ condition ]
        /bin/sh script_3.sh
   else
        /bin/sh script_4.sh
   fi
done

*Queries:*

-  If we create a separate profile for each script (for instance,
script1_1.sh)  and consolidate to one profile for foo.sh
-  However, we will try to perform/exercise all possible test cases to
execute all code paths while running in complain mode to gather logs
   for preparing the profiles.
-  Do we have any recommendations to prepare an Apparmor profile for Linux
scripts?

*Question 2:*

- In my embedded system most of the rootfs files are in READ-ONLY except a
few directory,files are READ-WRITE (for instance, non-volatile partitions
and so on).
- All libraries in my device rootfs are located in READ-ONLY folders (
/lib/, /usr/lib and so on).
- While preparing profiles for my applications, I am adding each entry of
the library as per the application access.

  /lib/** mr,
  /usr/lib/** mr,

- Since all libraries are in READ-ONLY, if we allow all libraries (with
wild-card) any possible security leak?
- Do we still have command-line injection possible to the library too? I am
trying to understand here, how do we affect security leaks if we allow all
libraries (since they are in READ-ONLY directory).

Thanks
Murali.S
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ubuntu.com/archives/apparmor/attachments/20220922/dfa3b8c1/attachment.html>