In this article, we review .apparmor type file in OpenMasuBot codebase. You will learn:
- What is OpenMausBot?
- What is AppArmor?
What is OpenMausBot?
MausBot turns agent CLIs into a familiar desktop chat app. Each bot can have its own model, instructions, working folder, connected apps, computer, and recurring work.
You can build a team of AI agents that can talk, use tools, operate computers, and keep working on a schedule.
MausBot is an open-source Grok Bot alternative with a virtual machine that bots can use.
Learn more about MausBot.
What is AppArmor?
I found a file named omb-home-narrow.apparmor in the MausBot codebase. I never came across such a file type ‘.apparmor’, so I googled what it means and found this apparmor.net/
AppArmor is an effective and easy-to-use Linux application security system. AppArmor proactively protects the operating system and applications from external or internal threats, even zero-day attacks, by enforcing good behavior and preventing both known and unknown application flaws from being exploited.
well, I also wondered if omb-home-narrow file name had any special meaning, but it did not. Below is a comment I picked from that file:
# omb-home-narrow: omb-home, plus a refusal of every filesystem type a user
# namespace may mount that bubblewrap
# never does (it mounts only tmpfs, proc and devpts, and binds). Overlay and
# FUSE in user namespaces are where most
# unprivileged-namespace kernel bugs have been; a bot cannot reach them
# through this container.
and this file also deny commands, preventing access to senstive files on your machine.
deny mount fstype=overlay,
deny mount fstype=fuse,
deny mount fstype=fuseblk,
deny mount fstype=sysfs,
deny mount fstype=mqueue,
deny mount fstype=cgroup,
deny mount fstype=cgroup2,
deny mount fstype=ramfs,
deny mount fstype=binfmt_misc,
deny mount fstype=bpf,
I found this snippet that could help us understand more about this file
profile omb-home-narrow flags=(attach_disconnected,mediate_deleted) {
AppArmor profiles are the fundamental building blocks of system security. They act as a set of rules that dictate exactly what a confined application is allowed to do.
Learn more about AppArmor profiles.
About me:
Hey, my name is Ramu Narasinga. Email: ramu.narasinga@gmail.com
I spent 3+ years studying OSS codebases and wrote 400+ articles on what makes the production-grade. Now I'm putting that into practice differently - instead of writing every fix myself, I run coding agents that do it.
How it works? Register your machine as a Runtime, point it at your repo. Agents pick up issues. write the fix, open the PR. You just review, they execute.
Build your coding agents and get more work done in less time at thinkthroo.com
Top comments (0)