cmake可见性和AppArmor示例

AppArmor/demo1/profile.script

@@ -0,0 +1,27 @@
+abi <abi/4.0>,
+
+/home/fnzhang/Project/examples/AppArmor/demo1/demo_shell.sh flags=(enforce) {
+    # 解释器与自身
+    /home/fnzhang/Project/examples/AppArmor/demo1/demo_shell.sh r,
+    /bin/bash rm,
+    /usr/bin/bash rm,
+    /etc/ld.so.cache r,
+    /lib/** rm,
+    /usr/lib/** rm,
+    /usr/lib64/** rm,
+
+    # bash 运行所需的基础文件
+    /etc/bash.bashrc r,
+    /etc/profile r,
+    /etc/profile.d/** r,
+    /home/fnzhang/.bashrc r,
+    /home/fnzhang/.profile r,
+    /dev/tty rw,
+
+    # 外部命令
+    /usr/bin/cat rm,
+
+    # 允许写目标文件、拒绝读 shadow
+    /tmp/demo_sh.log rw,
+    deny /etc/shadow r,
+}