I'm trying to write an apparmor profile to protect against windows malware run via wine. As I understand it, unless wine is run as root, it's not possible for windows apps to modify system files, but I'd like to further confine windows programs to just ~/.wine to protect user files, so that windows programs:

1) Cannot be run unless placed in the wine c drive

2) When run, cannot see or interact with any files outside of those in ~/.wine

I've read this page and it looks like the section about running all programs under wine-loader and wineserver profiles is what I'm looking for, but because I haven't tinkered with apparmor before I'd like to make sure that's actually the approach I should be using, and what changes I might need to make to the example profile there to make it work.

  • There's on github ready profile for Wine, I installed it a few days ago too. But I didn't test it yet, neither I enabled it because didn't have time for testing. Actually, I don't have a time even for writing this, I'm rather procrastinating ☺ Ah, note, that the profile using some templates higher up the directory, so you probably have to download it with git clone https://github.com/mk-fg/apparmor-profiles.git, and then copy to /etc/apparmor.d/ anything apparmor would start complaining about. – Hi-Angel Feb 9 '16 at 11:06
  • 1
    Thanks for the link. Since I have no experience with apparmor I'm hoping to get some more input from someone who can examine it and tell whether it accomplishes what I'm looking for, but this looks like a good place to start at the very least. – fire48 Feb 10 '16 at 13:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.