Hi All,
Please see below two queries and share your valuable inputs.
*Question 1: *
I am trying to generate an Apparmor profile similar to the below pseudo
script.
*foo.sh*
#!/bin/sh
if condition
/bin/sh script_1.sh
fi
/bin/sh script_2.sh
while [ condition ]
do
if [ condition ]
/bin/sh script_3.sh
else
/bin/sh script_4.sh
fi
done
*Queries:*
- If we create a separate profile for each script (for instance,
script1_1.sh) and consolidate to one profile for foo.sh
- However, we will try to perform/exercise all possible test cases to
execute all code paths while running in complain mode to gather logs
for preparing the profiles.
- Do we have any recommendations to prepare an Apparmor profile for Linux
scripts?
*Question 2:*
- In my embedded system most of the rootfs files are in READ-ONLY except a
few directory,files are READ-WRITE (for instance, non-volatile partitions
and so on).
- All libraries in my device rootfs are located in READ-ONLY folders (
/lib/, /usr/lib and so on).
- While preparing profiles for my applications, I am adding each entry of
the library as per the application access.
/lib/** mr,
/usr/lib/** mr,
- Since all libraries are in READ-ONLY, if we allow all libraries (with
wild-card) any possible security leak?
- Do we still have command-line injection possible to the library too? I am
trying to understand here, how do we affect security leaks if we allow all
libraries (since they are in READ-ONLY directory).
Thanks
Murali.S
