What are all the ways AppArmor profiles can be matched to processes? One seems to be path based (e.g. the /sbin/dhclient profile is applied when /sbin/dhclient is executed) but is this due to /sbin/dhclient appearing in the sbin.dhclient profile or because of the way sbin.dhclient is named?
Also, for non-path based profile matching (e.g. for the docker-default profile) how is AppArmor told which processes to apply the profile to?
AppArmor profiles using a mangled path of the command for the filename is just a convention. From man 7 apparmor:
Profiles are traditionally stored in files in
/etc/apparmor.d/under filenames with the convention of replacing the/in pathnames with.(except for the root/) so profiles are easier to manage (e.g. the/usr/sbin/nscdprofile would be namedusr.sbin.nscd).
The profile name, if it contains a file glob, applies to files matched by that glob. From the AppArmor Core Policy Reference:
The attachment specification is used by AppArmor to determine which executables a profile will attach to. If alternate profile name is not supplied the attachment specification is also used as the profiles name and if an attachment specification is not specified a profile name must be provided.
The name of a profile is very import in AppArmor. It provides not only a name(s) that users can associate to the set of profile rules, but is also used for labeling, ipc, and in the case that the name is an attachment specification it determines to which executables the profile attaches.
docker-default profile or other non-path based profile names?
Commented
Nov 19, 2018 at 17:08