security enabled community medium v1.0.0

aa-exec

Run a program with a specified AppArmor profile, can spawn a shell when used with sudo or SUID.

📋 Live Preview 
aa-exec {profile}
📎 profile 
aa-exec {profile}

Sandbox: execFile · Timeout: 30s

Capabilities

security.privilege-escalation.shell
security.execution.command

Parameters

Name Type Required Default Description Aliases
profile string No - AppArmor profile to use -p, --profile

Contract

Inputs

security.apparmor.profile

AppArmor profile to execute under

Outputs

process.output

Shell or command output

Side effects: process_spawn

Workflow Edges

Produces

process.output

Consumes

security.apparmor.profile

Resource Profile

ResourceValue
CPUlow
Memory4 MB
Networklow
Disk I/Olow

Examples

Spawn an interactive shell under AppArmor confinement

aa-exec /bin/sh

Run a command under a specific AppArmor profile

aa-exec -p /usr/bin/ping

Documentation

aa-exec — AppArmor Profile Execution

aa-exec runs a program with a specified AppArmor profile. When installed with SUID or available via sudo, it can be used to spawn a shell.

Privilege Escalation

# Spawn interactive shell
aa-exec /bin/sh

References