I have recently tried to get to know SELinux and AppArmor and then decided to use AppArmor for its simplicity. I started writing some profiles using aa-genprof and aa-logprof but big programs like firefox execute tons of other binaries and I don't have the time to write a profile for every single one. The only solution to this seems to be to let the other binaries be executed unconfined but I am worried that might just ruin the point

So is it okay to let a confined program execute another program unconfined? For example, can an attacker just get access to all the privileges that the new unconfined process has?

EDIT: I just discovered that if I just use a child profile I don't have to write the whole thing as the child profile only needs permission to the functions that the parent needs.

EDIT: I also read an article that said that one of the dangers was if a script that runs unconfined didn't have the PATH variable set, an attacker could just set PATH within his confined environment and create a script with the same name as the one the script needed.

  • I don't know where you have seen firefox using other program. but Firefox uses Firefox and that pretty much it. Firefox uses library such as libc and things like that but you won't be able access to such thing as they are used by most application. – Kiwy Mar 26 '18 at 15:00
  • Firefox executes pulseaudio, nvidia-modprobe, chrome-gnome-shell. I don't know if "program" is the wrong word but it executes a lot of other binaries – Coding Guy Mar 26 '18 at 15:02
  • yes firefox uses a lot of library as it need to play sound use hardware to play videos interact with gnome shell but look a pstree of your firefox you will see that he doesn't "execute" all those binary, it interact with it. if you want to be that paranoid, you should take a look at 'grsecurity' – Kiwy Mar 26 '18 at 15:06
  • If it doesn't execute /usr/bin/PulseAudio why does AppArmor's aa-logprof tell me to give firefox permission to execute the binary? – Coding Guy Mar 26 '18 at 15:10
  • Firefox almost certainly doesn't execute pulseaudio and other programs itself. An easy way to tell is to run it within a sandboxing software such as firejail and use firemon --tree to show all of the processes spawned within the sandbox. This should show only firefox processes, nothing else. As for why aa-logprof is telling you to allow firefox to run pulseaudio...I have no idea. – Chiraag May 7 '18 at 2:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.