404

:/ snap / core / 17284 / usr / share / apparmor / easyprof / policygroups / ubuntu-core / 16.04 /

Filename : system-monitor

# Description: Can query system status information. This is restricted because
# it gives privileged read access to all processes on the system and should
# only be used with trusted apps.
# Usage: reserved

# Needed by 'df'. This is an information leak
owner @{PROC}/@{pid}/mounts r,

# Needed by 'ps'
@{PROC}/tty/drivers r,

# This ptrace is an information leak
ptrace (read),

# ptrace can be used to break out of the seccomp sandbox, but ps requests
# 'ptrace (trace)' even though it isn't tracing other processes. Unfortunately,
# this is due to the kernel overloading trace such that the LSMs are unable to
# distinguish between tracing other processes and other accesses. We deny the
# trace here to silence the log.
deny ptrace (trace),