Novell APPARMOR 1.2, Administration Manual, Page: 70 / 130

TIP
The actual executable file for
/usr/bin/mail
turns out to be
/usr/bin/
nail
, which is not a typographical error.
The program
/usr/bin/less
appears to be a simple one for scrolling through text
that is more than one screen long and that is in fact what
/usr/bin/mail
is using
it for. However, less is actually a large and powerful program that makes use of many
other helper applications, such as tar and rpm.
TIP
Run
less
on a tar ball or an RPM file and it shows you the inventory of these
containers.
You do not want to automatically run rpm when reading mail messages (that leads di-
rectly to a Microsoft* Outlook–style virus attacks, because rpm has the power to install
and modify system programs) and so, in this case, the best choice is to use Inherit. This
results in the less program executed from this context running under the profile for
/usr/bin/mail
. This has two consequences:
• You need to add all of the basic file accesses for
/usr/bin/less
to the profile
for
/usr/bin/mail
.
• You can avoid adding the helper applications, such as tar and rpm, to the
/usr/
bin/mail
profile so that when
/usr/bin/mail
runs
/usr/bin/mail/
less
in this context, the less program is far less dangerous than it would be without
Novell AppArmor protection.
In other circumstances, you might instead want to use the Profile option. This has two
effects on logprof:
• The rule written into the profile is px, which forces the transition to the child's own
profile.
• logprof constructs a profile for the child and starts building it, in the same way that
it built the parent profile, by ascribing events for the child process to the child's
profile and asking the logprof user questions as above.
70