Can apparmor restrict interpreted languages?
For interpreted/vm languages(e.g. python, java, shell scripts) can apparmor be set to only confine a particular script or program? If so, how?
Yes it's possible. It's also in use in Ubuntu, especially on the phone.
To get a basic apparmor script, you can use aa-autodep from the apparmor-utils package.
Quick example for python:
cat >> ~/myapp << EOF
#! /usr/bin/python
EOF
sudo aa-autodep ~/myapp
cat /etc/apparmor.d/home.<user-name>.myapp
This will give you something like:
# Last Modified: Mon Feb 24 18:31:50 2014
#include <tunables/global>
/home/sam/myapp flags=(complain) {
#include <abstractions/base>
#include <abstractions/python>
/home/sam/myapp r,
/usr/bin/python2.7 ix,
}
Then you can expand on that.