abi <abi/4.0>,

/home/fnzhang/Project/examples/AppArmor/demo1/demo_shell.sh flags=(enforce) {
    # 解释器与自身
    /home/fnzhang/Project/examples/AppArmor/demo1/demo_shell.sh r,
    /bin/bash rm,
    /usr/bin/bash rm,
    /etc/ld.so.cache r,
    /lib/** rm,
    /usr/lib/** rm,
    /usr/lib64/** rm,

    # bash 运行所需的基础文件
    /etc/bash.bashrc r,
    /etc/profile r,
    /etc/profile.d/** r,
    /home/fnzhang/.bashrc r,
    /home/fnzhang/.profile r,
    /dev/tty rw,

    # 外部命令
    /usr/bin/cat rm,

    # 允许写目标文件、拒绝读 shadow
    /tmp/demo_sh.log rw,
    deny /etc/shadow r,
}