Glob
Select either a specific path or create a general rule using wild cards that matches
on a broader set of pathnames. To select any of the offered paths, enter the number
that is printed in front of the paths then decide how to proceed with the selected
item.
For more information about globbing syntax, refer to
Section 4.7, “Pathnames and
Globbing”
(page 68).
Glob w/Ext
This modifies the original directory path while retaining the filename extension.
For example,
/etc/apache2/file.ext
becomes
/etc/apache2/*.ext
,
adding the wild card (asterisk) in place of the filename. This allows the program
to access all files in the suggested directory that end with the
.ext
extension.
Abort
Aborts aa-logprof, losing all rule changes entered so far and leaving all profiles
unmodified.
Finish
Closes aa-logprof, saving all rule changes entered so far and modifying all profiles.
aa-logprof Example 2
In an example from profiling vsftpd, see this question:
Profile: /usr/sbin/vsftpd
Path: /y2k.jpg
New Mode: r
[1 - /y2k.jpg]
(A)llow / [(D)eny] / (N)ew / (G)lob / Glob w/(E)xt / Abo(r)t / (F)inish
Several items of interest appear in this question. First, note that vsftpd is asking for a
path entry at the top of the tree, even though vsftpd on openSUSE serves FTP files from
/srv/ftp
by default. This is because httpd2-prefork uses chroot and, for the portion
of the code inside the chroot jail, Novell AppArmor sees file accesses in terms of the
chroot environment rather than the global absolute path.
The second item of interest is that you might want to grant FTP read access to all JPEG
files in the directory, so you could use Glob w/Ext and use the suggested path of
64
Novell AppArmor Administration Guide
