Novell APPARMOR 1.2, Administration Manual, Page: 62 / 130

5 Answer two types of questions:
• A resource is requested by a profiled program that is not in the profile (see
Example 3.1, “Learning Mode Exception: Controlling Access to Specific
Resources”
(page 62)).
• A program is executed by the profiled program and the security domain
transition has not been defined (see Example 3.2, “Learning Mode Exception:
Defining Execute Permissions for an Entry” (page 63)).
Each of these categories results in a series of questions that you must answer to
add the resource to the profile or to add the program into the profile. The following
two figures show an example of each one. Subsequent steps describe your options
in answering these questions.
Example 3.1 Learning Mode Exception: Controlling Access to Specific Resources
Reading log entries from /var/log/messages.
Updating subdomain profiles in /etc/subdomain.d.
Profile: /usr/sbin/xinetd
Execute: /usr/sbin/vsftpd
[(I)nherit] / (P)rofile / (U)nconfined / (D)eny / Abo(r)t / (F)inish)
Dealing with execute accesses is complex. You must decide which of the three
kinds of execute permissions to grant the program:
inherit (ix)
The child inherits the parent's profile, running with the same access controls
as the parent. This mode is useful when a confined program needs to call
another confined program without gaining the permissions of the target's
profile or losing the permissions of the current profile. This mode is often
used when the child program is a helper application, such as the
/usr/bin/mail
client using the less program as a pager or the Mozilla
Web browser using the Acrobat program to display PDF files.
profile (px)
The child runs using its own profile, which must be loaded into the kernel.
If the profile is not present, attempts to execute the child fails with permission
denied. This is most useful if the parent program is invoking a global service,
such as DNS lookups or sending mail via your system's MTA.
62