Current File : //snap/core/17212/usr/share/apparmor/easyprof/policygroups/ubuntu-core/16.04/system-monitor
# Description: Can query system status information. This is restricted because
# it gives privileged read access to all processes on the system and should
# only be used with trusted apps.
# Usage: reserved
# Needed by 'df'. This is an information leak
owner @{PROC}/@{pid}/mounts r,
# Needed by 'ps'
@{PROC}/tty/drivers r,
# This ptrace is an information leak
ptrace (read),
# ptrace can be used to break out of the seccomp sandbox, but ps requests
# 'ptrace (trace)' even though it isn't tracing other processes. Unfortunately,
# this is due to the kernel overloading trace such that the LSMs are unable to
# distinguish between tracing other processes and other accesses. We deny the
# trace here to silence the log.
deny ptrace (trace),
Mini Shell