quest for access. For detailed information about the options available, refer
to
Section 4.8, “File Permission Access Modes”
(page 69).
Inherit
Stay in the same security profile (parent's profile).
Profile
Require a separate profile to exist for the executed program. When se-
lecting this option, also select whether AppArmor should sanitize the
environment when switching profiles by removing certain environment
variables that can modify the execution behavior of the child process.
Unless these variables are absolutely required to properly execute the
child process, always choose the more secure, sanitized option.
Unconfined
Execute the program without a security profile. When prompted, let
AppArmor sanitize the environment to avoid adding security risks by
inheriting certain environment variables from the parent process.
WARNING
Unless absolutely necessary, do not run unconfined. Choosing
the Unconfined option executes the new program without any
protection from AppArmor.
Deny
Click Deny to prevent the program from accessing the specified paths.
Abort
Abort aa-logprof, losing all rule changes entered so far and leaving all
profiles unmodified.
Finish
Close aa-logprof, saving all rule changes entered so far and modifying
all profiles.
9
Repeat the previous steps if you need to execute more functionality of the appli-
cation.
Building and Managing Profiles With YaST
31