<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"><html><head><meta content="text/html; charset=utf-8" http-equiv="Content-Type"></head><body>Could you include the relevant AppArmor lines from your /var/log/audit/audit.log or /var/log/messages files? <hr/><div><b>From: </b> Ahmet Emre Alada <aladagemre@gmail.com>
</div><div><b>Date: </b>Sun, 26 Aug 2012 19:27:08 +0300</div><div><b>To: </b><seth.arnold@gmail.com></div><div><b>Cc: </b><apparmor@lists.ubuntu.com></div><div><b>Subject: </b>Re: [apparmor] Allow defaults except for reading a directory</div><div><br/></div>Thank you very much for your answer,<br><br># Last Modified: Sun Aug 26 00:00:35 2012<br>#include <tunables/global><br><br>/home/research/.bin/pycharm-2.5.2/bin/pycharm.sh {<br> /** rwmixlk,<br> /usr/lib/jdk.1.7.0_06/bin/java rix,<br>
deny /home/research/Documents/ rw,<br> deny /home/research/Documents/** rwmxlk,<br>}<br><br>This did not deny the reading to Documents folder. Have I done what you meant correctly here?<br><br><br><div class="gmail_quote">
On Sun, Aug 26, 2012 at 7:09 PM, Seth Arnold <span dir="ltr"><<a href="mailto:seth.arnold@gmail.com" target="_blank">seth.arnold@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
If you write a profile for your pycharm.sh file and then give "ix" execute permissions to the java executable, the JVM spawned from pycharm.sh will inherit pycharm.sh's profile.<br>
<br>
You can add "deny" rules to prevent access to those files by those names. (If they are bind-mounted or hardlinked into pathnames that _are_ allowed, access will be granted if requested under those different names.)<br>
You may also wish to deny writes to AppArmor policies, kernel modules, kernels, and early startup programs, to reduce the chances the program can subvert AppArmor controls. (Though if pycharm.sh runs as a user, the standard Unix permissions should already do this.)<br>
<br>
It could look something like:<br>
<br>
/path/to/pycharm.sh {<br>
/** rwmixlk,<br>
deny /home/foo/Documents/ rw,<br>
deny /home/foo/Documents/** rwmxlk,<br>
}<br>
<br>
I'm less certain of the "x" on the deny line; check the apparmor.d(5) manpage for details. Also look in the /etc/apparmor.d/abstractions/ directory for more examples of "deny" rules (e.g., to prevent programs such as Firefox from reading your ~/.ssh/ files...)<br>
<br>
I hope this helps<br><br>
</blockquote></div>
</body></html>