I'm trying to sandbox a particular Python process, giving it access only to network communications and a select number of files on the file system. I followed the directions on the Ubuntu community docs site and the Chromium project's article on their sandboxing.
However, I only want to block some Python processes. To get aroundt this, I've symlinked the Python executable to another location (call it python sandbox
) and applied an AppArmor profile to it.
When I launch python-sandbox
, I am still able to open arbitrary files on the filesystem and read from them. What's wrong?
I've done the following:
Created an AppArmor profile as follows:
#include <tunables/global>
/opt/python-sandbox {
#include <abstractions/base>
#include <abstractions/fonts>
/proc/** r,
/usr/lib/python2.7/** r,
/usr/local/lib/python2.7/** r,
network,
}
Copied it into the /etc/apparmor.d/
directory with the name opt.python-sandbox
(since the symlink is to /opt/python-sandbox
.
Run apparmor_parser /etc/apparmor.d/opt.python-sandbox
.
Did I do something wrong? Should I consider another approach?