2
0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-22 10:07:12 +00:00

Update QuickProfileLanguage with ptrace summary

Ryan Lee 2024-08-21 16:46:05 +00:00
parent 04193990a4
commit b52327a5e0

@ -168,6 +168,29 @@ Rlimit Rules
TODO
Ptrace Rules
------------
There are four classes of ptrace operations:
- `trace`: trace another process using `ptrace`
- `tracedby`: be traced using `ptrace` by another process
- `read`: read certain proc filesystem information, kcmp, futexes, and perf trace events about another process
- `readby`: have certain proc filesystem information, kcmp, futexes, and perf trace events about oneself read by another process
The `peer=` option can be included to limit the profiles that the other process must be running under.
Example:
```
 /profile {
   ptrace, # Allow all ptrace operations
   ptrace (readby, tracedby) peer=unconfined, # Allow unconfined processes to ptrace us
 }
```
File rules
----------