3

I am running Ubuntu 16.04 with apparmor 2.10.95-0ubuntu2.7. I often need to comment on software of dubious quality. I want to employ apparmor to guard my system from harm.

I created an apparmor wildcard profile like this:

/home/username/testing/** {
  somerules
}

Unfortunately, this profile has no effect. It works as expected as soon as I put the exact path without a wildcard:

/home/username/testing/client42/executable {
  somerules
}

On the manpage, it looks like globbing is supported for profiles:

PROFILE = ( PROFILE HEAD ) [ ATTACHMENT SPECIFICATION ] [ PROFILE FLAG CONDS ] '{' ( RULES )* '}'
PROFILE HEAD = [ 'profile' ] FILEGLOB | 'profile' PROFILE NAME

This wiki article says so, too. There even is a user reporting success.

What am I missing?
Do wildcards in profiles need to be explicitly enabled in a configuration file?
Is globbing disabled in the Ubuntu build?

3

Tinkering around with this problem today, I found the wildcard profile working as expected after a reboot. It looks like setting the profile to enforce mode with aa-enforce /etc/apparmor.d/<profile> or reloading the profile with apparmor_parser -r /etc/apparmor.d/<profile> as described here and here is not sufficient for wildcard profiles. I am unsure if reloading the service via systemctl reload apparmor is sufficient to activate the wildcard profile, but a system restart definitely is.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.