<\/span><\/h4>\n\u0628\u06cc\u0627\u06cc\u06cc\u062f \u06cc\u06a9 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 AppArmor \u0631\u0627 \u0628\u0627 \u06cc\u06a9 \u0645\u062b\u0627\u0644 \u0639\u0645\u0644\u06cc \u062f\u0631\u06a9 \u06a9\u0646\u06cc\u0645.<\/p>\n
\u0645\u0627 \u06cc\u06a9 \u0627\u0633\u06a9\u0631\u06cc\u067e\u062a Bash \u0633\u0627\u062f\u0647 \u0627\u06cc\u062c\u0627\u062f \u062e\u0648\u0627\u0647\u06cc\u0645 \u06a9\u0631\u062f \u06a9\u0647 \u0633\u0639\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f \/etc\/shadow (\u0641\u0627\u06cc\u0644\u06cc \u06a9\u0647 \u062d\u0627\u0648\u06cc \u0631\u0645\u0632\u0647\u0627\u06cc \u0639\u0628\u0648\u0631 \u0647\u0634 \u0634\u062f\u0647 \u0627\u0633\u062a \u0648 \u0628\u0627\u06cc\u062f \u0645\u062d\u0627\u0641\u0638\u062a \u0634\u0648\u062f) \u0631\u0627 \u0628\u062e\u0648\u0627\u0646\u062f.<\/p>\n
\u0627\u06cc\u062f\u0647 \u0627\u06cc\u0646 \u0627\u0633\u062a \u06a9\u0647 \u0627\u0633\u06a9\u0631\u06cc\u067e\u062a \u0631\u0627 \u0627\u0632 \u062e\u0648\u0627\u0646\u062f\u0646 \/etc\/shadow\u060c \u062d\u062a\u06cc \u0647\u0646\u06af\u0627\u0645 \u0627\u062c\u0631\u0627 \u0628\u0647 \u0639\u0646\u0648\u0627\u0646 \u06a9\u0627\u0631\u0628\u0631 root\u060c \u0645\u0633\u062f\u0648\u062f \u06a9\u0646\u06cc\u0645.<\/p>\n
\u0628\u06cc\u0627\u06cc\u06cc\u062f \u0627\u0633\u06a9\u0631\u06cc\u067e\u062a \u0631\u0627 \u0627\u06cc\u062c\u0627\u062f \u06a9\u0646\u06cc\u0645.<\/p>\n
\r\n$ echo -e '#!\/bin\/bash\\ncat \/etc\/shadow' &amp;amp;gt; script.sh\r\n\r\n$ chmod +x script.sh\r\n<\/pre>\n\u0627\u06af\u0631 \u0627\u0633\u06a9\u0631\u06cc\u067e\u062a \u0631\u0627 \u0628\u0647 \u0639\u0646\u0648\u0627\u0646 root \u0627\u062c\u0631\u0627 \u06a9\u0646\u06cc\u062f\u060c \u0647\u06cc\u0686 \u062e\u0637\u0627\u06cc\u06cc \u062f\u0631\u06cc\u0627\u0641\u062a \u0646\u062e\u0648\u0627\u0647\u06cc\u062f \u06a9\u0631\u062f. \u0645\u062d\u062a\u0648\u0627\u06cc \/etc\/shadow \u0631\u0627 \u0646\u0645\u0627\u06cc\u0634 \u0645\u06cc\u200c\u062f\u0647\u062f.<\/p>\n
\r\n$ root@ubuntu:~# .\/script.sh\r\n\r\nroot:*:19579:0:99999:7:::\r\ndaemon:*:19579:0:99999:7:::\r\n.\r\n.\r\n.\r\n<\/pre>\n\u062d\u0627\u0644\u0627\u060c \u0628\u06cc\u0627\u06cc\u06cc\u062f \u06cc\u06a9 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 AppArmor \u0627\u06cc\u062c\u0627\u062f \u06a9\u0646\u06cc\u0645 \u06a9\u0647 \u0645\u0627\u0646\u0639 \u0627\u0632 \u062e\u0648\u0627\u0646\u062f\u0646 \/etc\/shadow \u062a\u0648\u0633\u0637 \u0627\u0633\u06a9\u0631\u06cc\u067e\u062a \u0634\u0648\u062f.<\/p>\n
\u0645\u0627 \u0627\u06cc\u0646 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 \u0631\u0627 \u062f\u0631 \/etc\/apparmor.d\/root.script.sh \u062a\u0639\u0631\u06cc\u0641 \u062e\u0648\u0627\u0647\u06cc\u0645 \u06a9\u0631\u062f.<\/p>\n
\r\n#include &lt;tunables\/global&gt;\r\n\r\nprofile \/root\/script.sh {\r\n# Allow reading its own file\r\n\/root\/script.sh r,\r\n\r\n# Deny access to \/etc\/shadow\r\ndeny \/etc\/shadow r,\r\n\r\n# Allow execution of Bash\r\n\/bin\/bash rmix,\r\n\r\n# Allow execution of 'cat' or any other needed commands\r\n\/usr\/bin\/cat rmix,\r\n}\r\n<\/pre>\n\u0628\u06cc\u0627\u06cc\u06cc\u062f \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 \u0631\u0627 \u0628\u0627\u0631\u06af\u0630\u0627\u0631\u06cc \u06a9\u0646\u06cc\u0645.<\/p>\n
\n
\r\nsudo apparmor_parser -r \/etc\/apparmor.d\/root.script.sh\r\n<\/pre>\n\u0648\u0636\u0639\u06cc\u062a \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n
\r\n$ root@ubuntu:~# sudo apparmor_status | grep script.sh\r\n\/root\/script.sh\r\n<\/pre>\n\n
\u0627\u06a9\u0646\u0648\u0646 \u0628\u0627\u06cc\u062f \u0645\u0633\u06cc\u0631 \u0635\u062d\u06cc\u062d (\/root\/script.sh) \u0631\u0627 \u0646\u0634\u0627\u0646 \u062f\u0647\u062f.<\/p>\n
\u062d\u0627\u0644\u0627 \u0628\u06cc\u0627\u06cc\u06cc\u062f \u0627\u0633\u06a9\u0631\u06cc\u067e\u062a \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u06cc\u0645 \u0648 \u0628\u0628\u06cc\u0646\u06cc\u0645 \u0686\u0647 \u0627\u062a\u0641\u0627\u0642\u06cc \u0645\u06cc\u200c\u0627\u0641\u062a\u062f. \u0647\u0646\u06af\u0627\u0645 \u062a\u0644\u0627\u0634 \u0628\u0631\u0627\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 \/etc\/shadow\u060c \u062d\u062a\u06cc \u0628\u0647 \u0639\u0646\u0648\u0627\u0646 root\u060c \u0628\u0627\u06cc\u062f \u062e\u0637\u0627\u06cc \u0639\u062f\u0645 \u0627\u062c\u0627\u0632\u0647 \u062f\u0633\u062a\u0631\u0633\u06cc \u062f\u0631\u06cc\u0627\u0641\u062a \u06a9\u0646\u06cc\u062f.<\/p>\n
\r\n$ root@ubuntu:~# .\/script.sh\r\n.\/script.sh: line 2: \/usr\/bin\/cat: Permission denied\r\n<\/pre>\n\u0647\u0645\u0627\u0646\u0637\u0648\u0631 \u06a9\u0647 \u0645\u06cc\u200c\u0628\u06cc\u0646\u06cc\u062f\u060c AppArmor \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0647\u0627 \u0631\u0627 \u0628\u0631 \u0627\u0633\u0627\u0633 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644\u200c\u0647\u0627 \u0645\u062d\u062f\u0648\u062f \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c \u062d\u062a\u06cc \u0627\u06af\u0631 \u0622\u0646\u0647\u0627 \u0631\u0627 \u0628\u0647 \u0639\u0646\u0648\u0627\u0646 root \u0627\u062c\u0631\u0627 \u06a9\u0646\u06cc\u062f.<\/p>\n
<\/span>\u0686\u0631\u0627 AppArmor Root \u0631\u0627 \u0645\u062d\u062f\u0648\u062f \u0645\u06cc\u200c\u06a9\u0646\u062f\u061f<\/span><\/h3>\nRoot \u062f\u0633\u062a\u0631\u0633\u06cc \u06a9\u0627\u0645\u0644 \u0628\u0647 \u0633\u06cc\u0633\u062a\u0645 \u062f\u0627\u0631\u062f\u060c \u0627\u0645\u0627 AppArmor \u06a9\u0646\u062a\u0631\u0644 \u0645\u06cc\u200c\u06a9\u0646\u062f \u06a9\u0647 \u06cc\u06a9 \u0628\u0631\u0646\u0627\u0645\u0647 (\u062d\u062a\u06cc \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0627\u06cc \u06a9\u0647 \u062a\u0648\u0633\u0637 root \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u0634\u0648\u062f) \u0686\u0647 \u06a9\u0627\u0631\u06cc \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0627\u0646\u062c\u0627\u0645 \u062f\u0647\u062f.<\/p>\n
\u0627\u06cc\u0646 \u0627\u0645\u0631 \u0627\u0632 \u062d\u0645\u0644\u0627\u062a privilege escalation\u062c\u0644\u0648\u06af\u06cc\u0631\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f (\u0628\u0647 \u0639\u0646\u0648\u0627\u0646 \u0645\u062b\u0627\u0644\u060c \u06cc\u06a9 \u0627\u0633\u06a9\u0631\u06cc\u067e\u062a root \u0622\u0633\u06cc\u0628\u200c\u062f\u06cc\u062f\u0647 \u0646\u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u062d\u0633\u0627\u0633 \u0645\u0627\u0646\u0646\u062f \/etc\/shadow \u062f\u0633\u062a\u0631\u0633\u06cc \u067e\u06cc\u062f\u0627 \u06a9\u0646\u062f). \u0627\u06cc\u0646 \u062d\u062f\u0627\u0642\u0644 \u0627\u0645\u062a\u06cc\u0627\u0632 \u0631\u0627 \u0627\u0639\u0645\u0627\u0644 \u0645\u06cc\u200c\u06a9\u0646\u062f \u0648 \u0641\u0642\u0637 \u0645\u062c\u0648\u0632\u0647\u0627\u06cc \u0644\u0627\u0632\u0645 \u0631\u0627 \u0645\u062c\u0627\u0632 \u0645\u06cc\u200c\u062f\u0627\u0646\u062f.<\/p>\n
<\/span>AppArmor \u062f\u0631 \u06a9\u0627\u0646\u062a\u06cc\u0646\u0631\u0647\u0627<\/span><\/h4>\nAppArmor \u062f\u0631 \u0631\u0627\u0646 \u062a\u0627\u06cc\u0645\u200c\u0647\u0627\u06cc \u06a9\u0627\u0646\u062a\u06cc\u0646\u0631 \u0627\u062f\u063a\u0627\u0645 \u0634\u062f\u0647 \u0627\u0633\u062a \u062a\u0627 \u06a9\u0646\u062a\u0631\u0644 \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u062c\u0628\u0627\u0631\u06cc (MAC) \u0631\u0627 \u0628\u0631 \u0631\u0648\u06cc \u0641\u0631\u0622\u06cc\u0646\u062f\u0647\u0627\u06cc \u06a9\u0627\u0646\u062a\u06cc\u0646\u0631 \u0627\u0639\u0645\u0627\u0644 \u06a9\u0646\u062f.
\n\u0632\u0645\u0627\u0646 \u0627\u062c\u0631\u0627 \u0627\u06cc\u0646 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644\u200c\u0647\u0627 \u0631\u0627 \u0647\u0646\u06af\u0627\u0645 \u0634\u0631\u0648\u0639 \u06cc\u06a9 \u06a9\u0627\u0646\u062a\u06cc\u0646\u0631 \u0628\u0627\u0631\u06af\u0630\u0627\u0631\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f \u0648 \u062a\u0636\u0645\u06cc\u0646 \u0645\u06cc\u200c\u06a9\u0646\u062f \u06a9\u0647 \u0647\u0631 \u06a9\u0627\u0646\u062a\u06cc\u0646\u0631 \u062f\u0631 \u06cc\u06a9 sandbox \u06a9\u0627\u0631 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n
\u0628\u0647 \u0639\u0646\u0648\u0627\u0646 \u0645\u062b\u0627\u0644\u060c Docker \u0628\u0627 \u06cc\u06a9 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 \u067e\u06cc\u0634\u200c\u0641\u0631\u0636 \u0628\u0647 \u0646\u0627\u0645 docker-default \u0627\u0631\u0627\u0626\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f. \u0627\u06cc\u0646 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 \u0628\u0631\u0627\u06cc \u0647\u0631 \u06a9\u0627\u0646\u062a\u06cc\u0646\u0631 \u0627\u0639\u0645\u0627\u0644 \u0645\u06cc\u200c\u0634\u0648\u062f \u0645\u06af\u0631 \u0627\u06cc\u0646\u06a9\u0647 \u0644\u063a\u0648 \u0634\u0648\u062f. \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u06cc\u062f \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 \u0631\u0627 \u0627\u06cc\u0646\u062c\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n
\u0627\u06cc\u0646 \u0628\u0631\u0646\u0627\u0645\u0647 \u0628\u0647 \u06af\u0648\u0646\u0647\u200c\u0627\u06cc \u0637\u0631\u0627\u062d\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647<\/p>\n
\n- \u0627\u062c\u0627\u0632\u0647 \u0639\u0645\u0644\u06cc\u0627\u062a \u0627\u0648\u0644\u06cc\u0647 (\u0645\u062b\u0644\u0627 \u062e\u0648\u0627\u0646\u062f\u0646\/\u0646\u0648\u0634\u062a\u0646 \u062f\u0631 \u0633\u06cc\u0633\u062a\u0645 \u0641\u0627\u06cc\u0644 \u06a9\u0627\u0646\u062a\u06cc\u0646\u0631) \u0631\u0627 \u0645\u06cc\u200c\u062f\u0647\u062f.<\/li>\n
- \u0627\u0642\u062f\u0627\u0645\u0627\u062a \u062e\u0637\u0631\u0646\u0627\u06a9 (\u0645\u062b\u0644\u0627 \u0646\u0635\u0628 \/proc \u06cc\u0627 \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 \/etc\/passwd \u0631\u0648\u06cc \u0645\u06cc\u0632\u0628\u0627\u0646) \u0631\u0627 \u0645\u0633\u062f\u0648\u062f \u0645\u06cc\u200c\u06a9\u0646\u062f.
\n\u062f\u0631 \u0627\u06cc\u0646 \u0628\u062e\u0634 \u06cc\u06a9 \u0645\u062b\u0627\u0644 \u0633\u0627\u062f\u0647 \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f \u06a9\u0647 \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 \u067e\u06cc\u0634\u200c\u0641\u0631\u0636 AppArmor \u062f\u0631 docker\u060c \u062e\u0648\u0627\u0646\u062f\u0646 \/proc\/sysrq-trigger \u0631\u0627 \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 cat \u0645\u0633\u062f\u0648\u062f \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/li>\n<\/ul>\n<\/span>\u0646\u062a\u06cc\u062c\u0647\u200c\u06af\u06cc\u0631\u06cc<\/span><\/h4>\nAppArmor \u0628\u0627 \u0645\u062d\u062f\u0648\u062f \u06a9\u0631\u062f\u0646 \u0627\u0642\u062f\u0627\u0645\u0627\u062a \u0628\u0631\u0646\u0627\u0645\u0647\u060c \u062c\u0644\u0648\u06af\u06cc\u0631\u06cc \u0627\u0632 \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647\u200c\u0647\u0627 \u0648 \u062a\u0636\u0645\u06cc\u0646 \u062d\u062f\u0627\u0642\u0644 \u0627\u0645\u062a\u06cc\u0627\u0632\u060c \u0627\u0645\u0646\u06cc\u062a \u0644\u06cc\u0646\u0648\u06a9\u0633 \u0631\u0627 \u0628\u0647\u0628\u0648\u062f \u0645\u06cc\u200c\u0628\u062e\u0634\u062f. \u062f\u0627\u0646\u0633\u062a\u0646 \u0627\u06cc\u0646 \u0645\u0648\u0636\u0648\u0639 \u0628\u0631\u0627\u06cc \u0645\u062f\u06cc\u0631\u0627\u0646 \u0633\u06cc\u0633\u062a\u0645 \u0648 \u0639\u0644\u0627\u0642\u0647\u200c\u0645\u0646\u062f\u0627\u0646 \u0628\u0647 CKS \u0636\u0631\u0648\u0631\u06cc \u0627\u0633\u062a!<\/p>\n","protected":false},"excerpt":{"rendered":"AppArmor \u06cc\u06a9 \u0633\u06cc\u0633\u062a\u0645 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0645\u0628\u062a\u0646\u06cc \u0628\u0631 \u06a9\u0646\u062a\u0631\u0644 \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u062c\u0628\u0627\u0631\u06cc (Mandatory Access Control – MAC) \u0628\u0631\u0627\u06cc \u0644\u06cc\u0646\u0648\u06a9\u0633 \u0627\u0633\u062a \u06a9\u0647…","protected":false},"author":1,"featured_media":3882,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"csco_singular_sidebar":"","csco_page_header_type":"","csco_page_load_nextpost":"","footnotes":""},"categories":[8,3],"tags":[],"class_list":{"0":"post-3768","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-server","8":"category-linux","9":"cs-entry"},"_links":{"self":[{"href":"https:\/\/parsdev.com/blog\/wp-json\/wp\/v2\/posts\/3768","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/parsdev.com/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/parsdev.com/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/parsdev.com/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/parsdev.com/blog\/wp-json\/wp\/v2\/comments?post=3768"}],"version-history":[{"count":16,"href":"https:\/\/parsdev.com/blog\/wp-json\/wp\/v2\/posts\/3768\/revisions"}],"predecessor-version":[{"id":4799,"href":"https:\/\/parsdev.com/blog\/wp-json\/wp\/v2\/posts\/3768\/revisions\/4799"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/parsdev.com/blog\/wp-json\/wp\/v2\/media\/3882"}],"wp:attachment":[{"href":"https:\/\/parsdev.com/blog\/wp-json\/wp\/v2\/media?parent=3768"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/parsdev.com/blog\/wp-json\/wp\/v2\/categories?post=3768"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/parsdev.com/blog\/wp-json\/wp\/v2\/tags?post=3768"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}