Novell APPARMOR 1.2, Administration Manual, Page: 75 / 130

3.7.1 Read Mode
Allows the program to have read access to the resource. Read access is required for
shell scripts and other interpreted content and determines if an executing process can
core dump or be attached to with
ptrace(2)
(
ptrace(2)
is used by utilities such
as
strace(1)
,
ltrace(1)
, and
gdb(1)
).
3.7.2 Write Mode
Allows the program to have write access to the resource. Files must have this permission
if they are to be unlinked (removed).
3.7.3 Discrete Profile Execute Mode
This mode requires that a discrete security profile is defined for a resource executed at
a Novell AppArmor domain transition. If there is no profile defined, the access is denied.
Incompatible with inherit and unconstrained execute entries.
3.7.4 Unconstrained Execute Mode
Allows the program to execute the resource without any Novell AppArmor profile being
applied to the executed resource. Requires listing execute mode as well. Incompatible
with inherit and discrete profile execute entries.
This mode is useful when a confined program needs to be able to perform a privileged
operation, such as rebooting the machine. By placing the privileged section in another
executable and granting unconstrained execution rights, it is possible to bypass the
mandatory constraints imposed on all confined processes. For more information about
what is constrained, see the
subdomain(7)
man page.
3.7.5 Inherit Execute Mode
Prevents the normal Novell AppArmor domain transition on
execve(2)
when the
profiled program executes the resource. Instead, the executed resource inherits the
current profile. Incompatible with unconstrained and discrete profile execute entries.
Building Novell AppArmor Profiles 75