In this lesson, you will learn how to implement strict globbing and precise path definitions to restrict process access to sensitive directories within your security profiles.
When configuring security frameworks like AppArmor, the strength of your protection relies heavily on how you define the file paths a process is allowed to touch. If you use overly broad definitions, you risk "path traversal" vulnerabilities where an attacker can escape the intended directory. To prevent this, we use globbing—special characters that act as wildcards—to enforce narrow, specific boundaries.
The Power of Precise Globbing
The goal of path-based restriction is the Principle of Least Privilege. You want to grant access only to the specific files required for the application to function.
Consider a web server that needs to read configuration files. Instead of providing broad access to /etc/, you should define the path with exact globbing:
# Secure: Restricts access to files only within the config subdirectory
/etc/myapp/conf/*.conf r,
# Dangerous: Grants access to everything in /etc/
/etc/** r,
Here, the *.conf glob ensures the process can only read files ending with the .conf extension. If you used *, it might accidentally include sensitive files like shadow or passwd if they were moved into that folder.
Avoiding Common Pitfalls
When defining paths, be wary of the ** recursive wildcard. While it is convenient for entire directory trees, it is often too permissive. For instance, /var/www/html/** allows access to every single file and subdirectory within that web root. If your application only needs to read files, use r (read) instead of rw (read-write) to prevent the process from modifying existing content.
Always verify your path definitions by running the application and checking the audit logs for DENIED messages. If the application crashes, tighten your glob until it works, rather than loosening the entire path scope. By combining strict path declarations with precise file-access modes, you create a hardened barrier that prevents unauthorized system probing.
Key Takeaway: Always use the most restrictive glob possible—such as *.extension rather than *—to ensure processes remain confined within their intended operational boundaries.