404

:/ snap / core / current / usr / share / seccomp / policygroups / ubuntu-core / 16.04 /

Filename : system-monitor

# Description: Can query system status information. This is restricted because
# it gives privileged read access to all processes on the system and should
# only be used with trusted apps.
# Usage: reserved

# ptrace can be used to break out of the seccomp sandbox, but ps requests
# 'ptrace (trace)' from apparmor. 'ps' does not need the ptrace syscall though,
# so we deny the ptrace here to make sure we are always safe.
deny ptrace