<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style> </head> <body dir="ltr"> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> Thank you for the reply John, Seth. It's great to know that a more expressive policy language is in the works.</div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <br> </div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> We had a good look at stacking, but it doesn't seem to help accomplish quite what we have in mind:</div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <br> </div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> a) Confine 'init'</div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> b) When init executes any other process, perform a discrete profile transition. But, if no discrete profile exists, transition to a 'default' (highly restricted) child profile defined in init's profile (this is basically what would be a 'pcx' transition).</div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <br> </div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> Even if we were to specify the default profile as a discrete profile, the following example is the closest that stacking can bring us to what we would like, and hopefully illustrates our problem better:</div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <br> </div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> profile init-systemd /**</div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> {</div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> /program px -> program //& default</div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> }</div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <br> </div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> profile default</div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> {</div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> . . .</div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> }</div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <br> </div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> a) If the discrete profile for 'program' doesn't exist, I understand that '<span style="font-family: Calibri, Arial, Helvetica, sans-serif; background-color: rgb(255, 255, 255); display: inline !important">program //& default' would evaluate to just 'default', which is what we would like. So far so good.</span></div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <span style="font-family: Calibri, Arial, Helvetica, sans-serif; background-color: rgb(255, 255, 255); display: inline !important">b) But, if the discrete profile for 'program' does exist, we would like it to transition here, and not perform an intersection of 'program' and 'default'. Since 'default' is highly restrictive, this would result in the intersection of the 2 profiles becoming highly restrictive as well.</span></div> <div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0);"> <br> <hr tabindex="-1" style="display:inline-block; width:98%;"> <b>From:</b> Seth Arnold<br> <b>Sent:</b> Tuesday, 01 October 2019 23:47<br> <b>To:</b> Abhishek Vijeev<br> <b>Cc:</b> apparmor@lists.ubuntu.com; Rakesh Rajan Beck<br> <b>Subject:</b> Re: [apparmor] Query about AppArmor's Profile Transitions <div><br> </div> </div> <div class="BodyFragment"><font size="2"><span style="font-size:11pt;"> <div class="PlainText">On Tue, Oct 01, 2019 at 05:25:21PM +0000, Abhishek Vijeev wrote:<br> > Currently, AppArmor allows 'pix' and 'cix' transitions. However, we would like to extend AppArmor to<br> > allow a 'pcix' transition. To clarify what we mean by 'pcix', we're looking for a way by which we<br> > can specify the following policy: 'look for a specific profile, but if one doesn't exist, look for a<br> > child profile, otherwise inherit the current profile'. Are there any challenges to implementing<br> > this? Also, is this a feature that is planned for release in future versions of AppArmor?<br> <br> I do have to wonder if whatever you're trying to solve would be better<br> handled via stacking profiles instead.<br> <br> What are you trying to achieve?<br> <br> Thanks<br> </div> </span></font></div> </body> </html>