cmake可见性和AppArmor示例

AppArmor/demo1/demo_app.c

@@ -0,0 +1,36 @@
+#define _GNU_SOURCE
+#include <stdio.h>
+#include <unistd.h>
+
+int main(void)
+{
+    /* 探针1: 白名单文件 —— profile 中 /tmp/demo_elf.log rw, 应当成功 */
+    FILE* fp = fopen("/tmp/demo_elf.log","w");
+    if(fp){
+        fprintf(fp,"elf write ok\n");
+        fclose(fp);
+        printf("[probe1] write /tmp/demo_elf.log: ALLOWED\n");
+    }else{
+        perror("[probe1] open /tmp/demo_elf.log");
+    }
+
+    /* 探针2: 显式 deny 规则 —— deny /etc/shadow r, 静默拒绝, 不产生审计日志 */
+    fp = fopen("/etc/shadow","r");
+    if(fp){
+        printf("[probe2] read /etc/shadow: ALLOWED (unexpected!)\n");
+        fclose(fp);
+    }else{
+        perror("[probe2] open /etc/shadow");
+    }
+
+    /* 探针3: 未在 profile 中列出的路径 —— 隐式默认拒绝(enforce), 拒绝并记录 DENIED 日志 */
+    fp = fopen("/tmp/demo_forbidden.log","w");
+    if(fp){
+        fprintf(fp,"should not be here\n");
+        fclose(fp);
+        printf("[probe3] write /tmp/demo_forbidden.log: ALLOWED (unexpected!)\n");
+    }else{
+        perror("[probe3] open /tmp/demo_forbidden.log");
+    }
+    return 0;
+}