execution via bang-line not mediated by apparmor

Okay, I've got a minimal test for this that doesn't rely upon anything outside of these files.

cp ~/Downloads/confined_interpreter.c /tmp
cd /tmp
make confined_interpreter
sudo -s
apparmor_parser --replace <<EOF
profile /tmp/confined_interpreter {
  /etc/ld.so.cache r,
  /lib/x86_64-linux-gnu/libc-2.19.so rm,
  /tmp/confined_interpreter ix,
  /tmp/runme.pl wix,
}
EOF
exit
/tmp/confined_interpreter

Even though /tmp/confined_interpreter is executing in a profile that doesn't include /usr/bin/perl in any way, the /usr/bin/perl executable is started, as evidenced by failure to load perl libraries:

/usr/bin/perl: error while loading shared libraries: libperl.so.5.18: cannot open shared object file: Permission denied

type=AVC msg=audit(1405991249.694:8453): apparmor="DENIED" operation="open" profile="/tmp/confined_interpreter" name="/usr/lib/libperl.so.5.18.2" pid=13472 comm="runme.pl" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

This behaviour is expected; the 'executable' in this case is the shell script (/tmp/runme.pl in my example, ~/hello.pl in your example) -- and the interpreter is invoked almost as an aside.

We could investigate extending this as a feature request; I don't know if the design of binfmt_misc would make it 'easy' to add permission checks to the interpreter, but we wouldn't want to do it without some level of wider discussion first.

Thanks

Alright I changed this to confirmed (it is a known behavior) and wishlist.

Yes this could be addressed in the kernel fairly easily. It does change existing known behavior, and discussion of whether this is a desired change is needed.

Note: it would now also be fairly trivial to make this abi dependent so that older policy would get the old behavior and new policy the new behavior if it was decided that this is a desired change.

One data point from myself (as a relatively experienced user of AppArmor, but no expert whatsoever): I was surprised to read this bug report, so to some degree this behaviour violates the principle of least surprise. Wishlist sounds fine, though.