Apparmor配置文件不能运行whoami

Question

我有一个在虚拟环境中运行的Python应用程序，我正在尝试为它构建一个apparmor配置文件。它有一个包装器，如下所示：

#!/bin/bash

## This script is for running the 'fact' command on staging/prod, it sudos to
## the 'fact' user before executing /opt/fact-virtual-environment/bin/fact

## It is installed as '/usr/bin/fact'

WHOAMI=$(whoami)
PYTHONPATH=/usr/share/fact
PYTHON_BIN=/opt/fact-virtual-environment/bin/python
DJANGO_SETTINGS_MODULE=fact.settings.staging

if [ "${WHOAMI}" != "fact" ];
then
  sudo -u fact $0 $*;
else
  PYTHONPATH=${PYTHONPATH} DJANGO_SETTINGS_MODULE=${DJANGO_SETTINGS_MODULE}  ${PYTHON_BIN} -m fact.managecommand $*;
fi

因此，在开始之前，我们总是要确保对正确的用户执行sudo操作。但是，即使在ux上运行sudo和correct (如下所示，是的，我知道ux是坏的/不安全的)，whoami仍然无法获得正确的用户ID。

# Last Modified: Tue Jan 20 09:25:09 2015
#include <tunables/global>

/usr/bin/fact {
  #include <abstractions/apache2-common>
  #include <abstractions/base>
  #include <abstractions/bash>


  capability setgid,
  capability sys_resource,


  deny /etc/group r,
  deny /etc/passwd r,
  deny /usr/local/lib/python2.7/dist-packages/ r,
  deny /usr/local/lib/python2.7/site-packages/ r,

  /usr/bin/sudo ux,
  /usr/bin/whoami ux,

  /bin/bash rix,
  /bin/dash rix,
  /bin/uname rix,
  /dev/tty rw,
  /etc/default/locale r,
  /etc/group r,
  /etc/passwd r,
  /etc/environment r,
  /etc/login.defs r,
  /etc/lsb-release r,
  /etc/fact/fact.ini r,
  /etc/python2.7/sitecustomize.py r,
  #/etc/security/pam_env.conf r,
  /lib{,32,64}/** mr,
  /opt/fact-virtual-environment/** mr,
  /opt/fact-virtual-environment/bin/python rix,
  #/proc/*/fd/ r,
  #/proc/*/mounts r,
  #/proc/filesystems r,
  #/proc/loadavg r,
  #/proc/meminfo r,
  #/proc/sys/kernel/ngroups_max r,
  #/run/utmp rk,
  /sbin/ldconfig rix,
  /sbin/ldconfig.real rix,
  /usr/bin/fact rix,
  /usr/lib{,32,64}/** mr,
  /usr/share/fact/ r,
  /usr/share/fact/fact/** r,
  /usr/share/pyshared/** r,

}

以及错误：

fact
whoami: cannot find name for user ID 1010
whoami: cannot find name for user ID 111
fact is not in the sudoers file.  This incident will be reported.

因为它不能确定我以哪个用户身份运行，所以它无论如何都要sudo到事实，然后抱怨，因为事实不能sudo。要让whoami正确运行，需要什么样的指令器设置？

Answer 1

我用$USER替换了whoami命令。这似乎是唯一可行的解决方案。