Can apparmor restrict interpreted languages?

For interpreted/vm languages(e.g. python, java, shell scripts) can apparmor be set to only confine a particular script or program? If so, how?


Yes it's possible. It's also in use in Ubuntu, especially on the phone.

To get a basic apparmor script, you can use aa-autodep from the apparmor-utils package.

Quick example for python:

cat >> ~/myapp << EOF
#! /usr/bin/python
EOF

sudo aa-autodep ~/myapp

cat /etc/apparmor.d/home.<user-name>.myapp

This will give you something like:

# Last Modified: Mon Feb 24 18:31:50 2014
#include <tunables/global>

/home/sam/myapp flags=(complain) {
  #include <abstractions/base>
  #include <abstractions/python>

  /home/sam/myapp r,
  /usr/bin/python2.7 ix,

}

Then you can expand on that.