Define current process's PID in apparmor profile

[Uzair Shamim]

Hi,

Would it be possible to implement a feature that allows administrators to define rules in the apparmor profile so that it uses the PID of the program the profile applies to?

The current setup will only allow rules like this:
/proc/*/something

It would be much more useful to be able to say something like this:
/proc/THISPID/something

[Seth Arnold (seth-arnold)]

The long-term plan is to add kernel-side variable support for some features, including one for pids. The @{pid} variable is today a fairly ugly regex that matches pids and will one day match the current process's pid. The @{pids} variable will remain the fairly ugly regex that matches pids, so that an easy way to express "all pids" remains.

Thanks

[John Johansen (jjohansen)]

This requires the kernel vars feature to fix.

This requires the following updates
- kernel
   - variables support
   - updates to matching engine to match variables instances
   - unpack of ehfa
- parser/compiler
  - build ehfa with that can match variables

[Jamie Strandboge (jdstrand)]

FYI, implementing this feature would address a couple of information leaks in snappy security policy.