??????2?????????

????Apparmor????????????????setrlimit???????????????????????????????????????????????????????д??

????set rlimit [resource] <= [value]??

??????resource?????????????value???????????

?????????????????????????????????????????д??

????set rlimit as<=1M?? ???????????????????1M??

???????Apparmor???????????????????????????fsize??data??stack??core??rss??as??memlock??msgqueue???????????????????????CPU?????????????????OJ?????ACMer?????????????????????????????????Apparmor????OJ????????飬???????????????CPU???????????

??????3??????????

????Apparmor?????????????????????????????????????????????

????network [ [domain] [type] [protocol] ]

????????????????????domain??type??protocol??????

??????ó????????????е????????????????????????д??

????network??

?????????????????IPv4?????TCPЭ?飬????????д??

????network inet tcp??

????(4)capability???

????Capability statements are simply the word capability followed by the name of the POSIX.1e capability as defined in the capabilities(7) man page.

??????linux???????????????capablities?б??apparmor?????????????????????б??????????磺

????capability setgid??????????????setgid??????

?????????????????д

?????????????д????????????????????/etc/apparmor.d??????￡?????и?????????????????????????????

????sudo genprof [filename]

??????????????????????????????????????????????