Re: AA confining bash

Am 03.10.2014 um 23:23 schrieb Carlos E. R.:
> On 2014-10-03 22:42, pinguin74 wrote:
>> With regard to the lates Bash Shock, I wonder does it make sense to
>> confine Bash with AppArmor after all?
> 
> No.
> It is used by everything, needs access everywhere.

> You can confine the parent and its children, when you know in advance
> what the parent is going to do for months to come.

I think with aa-notify you can learn quickly if the profile needs
adjustment, so it should work if Bash inherits the main profile.

I tried this with clamscan, Thunderbird and Firefox, they all invoke
bash. And never had complaints bash couldn´t access something!

Best regards

-----BEGIN PGP SIGNATURE-----

iQEcBAEBAwAGBQJULxjrAAoJEEbP47fJHDB6bN0IALktwGWuDu4lQYU5etkI4/6l
4vzd91+FB+vJVIqYvCN6G0CT8GhIRvbFWR0BLrsNGT6BDG+HDvX5cAuCMUYNTp98
RW6O+DdWqPtELPHn9cEJVbLJJtbiyiJaY24qJOhFqp/Q3oOsvvvKGbFbD5yBlRvJ
tPA0jkaSgQJjdi9NDRlwydC8ufgjsZjhkvK3BNroHVcaUk15UzxPTGEJ+SB9lG1O
LmpblDvXfgUvq7bEl6IVX/K7rxZlsUPibVKRAZMBkWzSpIQjnm64tpiNC1hA/ZZT
vFYwE6fBEGvxBTJAXnWOEg6tEK2LPCFGQ0/nfz+q5+8krs0xFRF87bBKkhm/s3w=
=Wjge
-----END PGP SIGNATURE-----