Write Mode (w)
Allows the program to have write access to the resource. Files must have this per-
mission if they are to be unlinked (removed).
Discrete Profile Execute Mode (px)
This mode requires that a discrete security profile is defined for a resource executed
at a Novell AppArmor domain transition. If there is no profile defined, the access
is denied.
WARNING: Using the Discrete Profile Execute Mode
px
does not scrub the environment of variables such as
LD_PRELOAD
. As
a result, the calling domain may have an undue amount of influence over
the callee.
Incompatible with
Ux
,
ux
,
Px
, and
ix
.
Discrete Profile Execute Mode (Px)—Clean Exec
Px
allows the named program to run in
px
mode, but AppArmor invokes the Linux
kernel's
unsafe_exec
routines to scrub the environment, similar to setuid pro-
grams. See
ld.so(8)
for some information about setuid and setgid environment
scrubbing.
Incompatible with
Ux
,
ux
,
px
, and
ix
.
Unconstrained Execute Mode (ux)
Allows the program to execute the resource without any Novell AppArmor profile
applied to the executed resource. Requires listing execute mode as well.
This mode is useful when a confined program needs to be able to perform a privi-
leged operation, such as rebooting the machine. By placing the privileged section
in another executable and granting unconstrained execution rights, it is possible to
bypass the mandatory constraints imposed on all confined processes. For more in-
formation about what is constrained, see the
apparmor(7)
man page.
WARNING: Using Unconstrained Execute Mode (ux)
Use
ux
only in very special cases. It enables the designated child processes
to be run without any AppArmor protection.
ux
does not scrub the envi-
ronment of variables such as
LD_PRELOAD
. As a result, the calling domain
70
Novell AppArmor Administration Guide