the child process. This option introduces a security vulnerability that could be used
to exploit AppArmor. Only use it as a last resort.
mmap (m)
This permission denotes that the program running under the profile can access the
resource using the mmap system call with the flag
PROT_EXEC
. This means that
the data mapped in it can be executed. You are prompted to include this permission
if it is requested during a profiling run.
In the following example, the
/usr/bin/mail
mail client is being profiled and aa-
logprof has discovered that
/usr/bin/mail
executes
/usr/bin/less
as a helper
application to “page” long mail messages. Consequently, it presents this prompt:
/usr/bin/nail -> /usr/bin/less
(I)nherit / (P)rofile / (U)nconfined / (D)eny
TIP
The actual executable file for
/usr/bin/mail
turns out to be
/usr/bin/
nail
, which is not a typographical error.
The program
/usr/bin/less
appears to be a simple one for scrolling through text
that is more than one screen long and that is in fact what
/usr/bin/mail
is using
it for. However, less is actually a large and powerful program that makes use of many
other helper applications, such as tar and rpm.
TIP
Run
less
on a tar file or an RPM file and it shows you the inventory of these
containers.
You do not want to automatically run rpm when reading mail messages (that leads di-
rectly to a Microsoft* Outlook–style virus attack, because rpm has the power to install
and modify system programs) and so, in this case, the best choice is to use Inherit. This
results in the less program executed from this context running under the profile for
/usr/bin/mail
. This has two consequences:
• You need to add all of the basic file accesses for
/usr/bin/less
to the profile
for
/usr/bin/mail
.
66
Novell AppArmor Administration Guide