I have recently tried to get to know SELinux and AppArmor and then decided to use AppArmor for its simplicity. I started writing some profiles using aa-genprof and aa-logprof but big programs like firefox execute tons of other binaries and I don't have the time to write a profile for every single one. The only solution to this seems to be to let the other binaries be executed unconfined but I am worried that might just ruin the point
So is it okay to let a confined program execute another program unconfined? For example, can an attacker just get access to all the privileges that the new unconfined process has?
EDIT: I just discovered that if I just use a child profile I don't have to write the whole thing as the child profile only needs permission to the functions that the parent needs.
EDIT: I also read an article that said that one of the dangers was if a script that runs unconfined didn't have the PATH variable set, an attacker could just set PATH within his confined environment and create a script with the same name as the one the script needed.