Novell APPARMOR 1.2, Administration Manual, Page: 67 / 130

In this example, the access to
/etc/group
is part of httpd2-prefork accessing name
services. The appropriate response is
1
, which pulls in a predefined set of Novell
AppArmor rules. Selecting
1
to
#include
the name service package resolves all of
the future questions pertaining to DNS lookups and also makes the profile less brittle
in that any changes to DNS configuration and the associated nameservice profile
package can be made just once, rather than needing to revise many profiles.
Profile: /usr/sbin/httpd2-prefork
Path: /etc/group
New Mode: r
[1 - #include <abstractions/nameservice>]
2 - /etc/group
[(A)llow] / (D)eny / (N)ew / (G)lob / Glob w/(E)xt / Abo(r)t / (F)inish
Select one of the following responses:
Press Enter
Allows access to the selected directory path.
Allow
Allows access to the specified directory path entries. Novell AppArmor suggests
file permission access. For more information about this, refer to
Section 3.7, “File
Permission Access Modes” (page 74).
Deny
Prevents the program from accessing the specified directory path entries. Novell
AppArmor then moves on to the next event.
New
Prompts you to enter your own rule for this event, allowing you to specify whatever
form of regular expression you want. If the expression you enter does not actually
satisfy the event that prompted the question in the first place, Novell AppArmor
asks you for confirmation and lets you reenter the expression.
Glob
Clicking this modifies the directory path (by using wild cards) to include all files
in the suggested entry directory. Double-clicking it grants access to all files and
subdirectories beneath the one shown.
For more information about globbing syntax, refer to Section 3.6, “Pathnames and
Globbing” (page 73).
Building Novell AppArmor Profiles 67