On Thu, Jan 07, 2016 at 08:33:38PM -0500, Simon Deziel wrote: > > BTW: DBUS support in SSH? I didn't even imagine it could be there ;-) > > Any hints what it does? > > That's the first thing I tripped on when enabling the profile in 14.04. > > Upon connection, it sends a Hello to org.freedesktop.DBus then create > the session via org.freedesktop.login1.Manager. The ReleaseSession is > when you log out.
Sounds a bit like a PAM module. It might make sense to figure out which one and create an abstraction for it. > Did I misunderstood how Ux work? Say I have a profile defined for > /bin/bash would Ux allow a transition to it? You _really_ don't want a /bin/bash profile. :) So many tools expect it to work for so many different tasks that providing a generic profile for it is going to an exercise in futility -- it would need to be extremely wide and permissive to avoid impacting the system's usability that it would provide nearly no security value. Having /bin/bash inherit the profile from its callers, or have a child profile from its callers, or explicit application-controlled domain transitions from its callers, are all going to be far better approaches. If you want interactive users to have confined shells then the best approach is probably to use pam_apparmor in the PAM stack. (Perhaps in the common-session file if you want to ensure new services get the configuration too. Granted, pam_apparmor currently requires the authenticating service to also be confined because it uses aa_change_hat() instead of aa_change_profile() or aa_change_onexec() -- though that ought to be easily addressed...) Thanks
signature.asc
Description: Digital signature
-- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
