2

I'm trying to write an apparmor profile to protect against windows malware run via wine. As I understand it, unless wine is run as root, it's not possible for windows apps to modify system files, but I'd like to further confine windows programs to just ~/.wine to protect user files, so that windows programs:

1) Cannot be run unless placed in the wine c drive

2) When run, cannot see or interact with any files outside of those in ~/.wine

I've read this page and it looks like the section about running all programs under wine-loader and wineserver profiles is what I'm looking for, but because I haven't tinkered with apparmor before I'd like to make sure that's actually the approach I should be using, and what changes I might need to make to the example profile there to make it work.

Improve this question
2
  • There's on github ready profile for Wine, I installed it a few days ago too. But I didn't test it yet, neither I enabled it because didn't have time for testing. Actually, I don't have a time even for writing this, I'm rather procrastinating ☺ Ah, note, that the profile using some templates higher up the directory, so you probably have to download it with git clone https://github.com/mk-fg/apparmor-profiles.git, and then copy to /etc/apparmor.d/ anything apparmor would start complaining about.
    – Hi-Angel
    Feb 9, 2016 at 11:06
  • 1
    Thanks for the link. Since I have no experience with apparmor I'm hoping to get some more input from someone who can examine it and tell whether it accomplishes what I'm looking for, but this looks like a good place to start at the very least.
    – fire48
    Feb 10, 2016 at 13:48

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .