How do I use AppArmor to disable the execution of specific executables from bash?

Question

I have an AppArmor profile which allows everything except for writing to /etc/hosts. I would like to also make it impossible to execute iptables. Other than that, I want bash to behave completely normally. The following is the policy I have, but it has no effect on iptables. I'd like to understand why and what I can do about it.

#include <tunables/global>

profile /usr/bin/bash {
  # Allow everything
  capability,
  network,
  mount,
  remount,
  umount,
  pivot_root,
  ptrace,
  signal,
  dbus,
  unix,
  file,
  change_profile,

  # But deny write access to /etc/hosts
  deny /etc/hosts w,
  deny /usr/bin/iptables x,
}

After verifying the bash process is enforce mode, I get the following result.

> which iptables
/usr/bin/iptables
> iptables
iptables v1.8.11 (legacy): no command specified

I would expect a permission denial.

Answer 1

The problem is that iptables was a symlink. Apparently symlinks can be used to bypass AppArmor. That's pathetic. I updated the policy to block xtables-legacy-multi and it worked fine.

# ls -lh /usr/bin/iptables
lrwxrwxrwx 1 root root 20 22 mar 18.58 /usr/bin/iptables -> xtables-legacy-multi
# iptables
-bash: /usr/bin/iptables: Permission denied