On 2016-01-08 02:04 AM, Seth Arnold wrote: > On Thu, Jan 07, 2016 at 08:33:38PM -0500, Simon Deziel wrote: >>> BTW: DBUS support in SSH? I didn't even imagine it could be there ;-) >>> Any hints what it does? >> >> That's the first thing I tripped on when enabling the profile in 14.04. >> >> Upon connection, it sends a Hello to org.freedesktop.DBus then create >> the session via org.freedesktop.login1.Manager. The ReleaseSession is >> when you log out. > > Sounds a bit like a PAM module. It might make sense to figure out which > one and create an abstraction for it.
Seems to be libpam-systemd as pointed by Simon McVittie (thanks). >> Did I misunderstood how Ux work? Say I have a profile defined for >> /bin/bash would Ux allow a transition to it? > > You _really_ don't want a /bin/bash profile. :) So many tools expect it to > work for so many different tasks that providing a generic profile for it > is going to an exercise in futility -- it would need to be extremely wide > and permissive to avoid impacting the system's usability that it would > provide nearly no security value. > > Having /bin/bash inherit the profile from its callers, or have a child > profile from its callers, or explicit application-controlled domain > transitions from its callers, are all going to be far better approaches. Granted, the rational was to not prevent someone from confining a shell if they wanted to. I never intended to use it myself as like you mentioned pam_apparmor is better suited for the job. Let's drop that "P" then :) Regards, Simon
signature.asc
Description: OpenPGP digital signature
-- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
