cmake可见性和AppArmor示例

AppArmor/demo1/demo_shell.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+# 探针1: 白名单文件 —— profile 中 /tmp/demo_sh.log rw, 应当成功
+echo "[probe1] shell try write /tmp/demo_sh.log"
+echo "shell write ok" > /tmp/demo_sh.log && echo "[probe1] write /tmp/demo_sh.log: ALLOWED"
+
+# 探针2: 显式 deny —— deny /etc/shadow r, 静默拒绝
+echo "[probe2] shell try read /etc/shadow"
+cat /etc/shadow && echo "[probe2] read /etc/shadow: ALLOWED (unexpected!)"
+
+# 探针3: 未列出的路径 —— 隐式默认拒绝, 记录 DENIED 日志
+echo "[probe3] shell try write /tmp/demo_forbidden.log"
+echo "should not be here" > /tmp/demo_forbidden.log && echo "[probe3] write /tmp/demo_forbidden.log: ALLOWED (unexpected!)"
+
+exit 0