User
’
s
Gui
de
66
The program
/usr/bin/less
appears to be a simple one for scroll-
ing through text that is more than one screen long, and that is in fact
what
/usr/bin/mail
is using it for. However,
less
is actually a
large and powerful program that makes use of many other helper appli-
cations, such as
tar
and
rpm
.
1
We notably do
not
want to automatically invoke rpm when reading mail
messages (that leads directly to a Microsoft Outlook style virus attack,
because rpm needs the power to install and modify system programs)
and
so
i
n
t
hi
s
case
t
he
best
choi
ce
i
s
t
o
use
“
I
”
nher
i
t
.
Thi
s
wi
l
l
r
esul
t
i
n
the less program executed
from this context
running under the profile
for
/usr/bin/mail
. This has two consequences:
•
We will need to add all of the basic file accesses for /usr/bin/less
to the profile for
/usr/bin/mail
.
•
We can
avoid
adding the helper applications such as tar and
rpm to the
/usr/bin/mail
profile, so that when
/usr/bin/mail
runs
/usr/bin/mail
/
less
in this context,
the less program is
far less dangerous
than it would be without
Novell AppArmor protection.
I
n
ot
her
ci
r
cumst
ances,
we
may
i
nst
ead
want
t
o
use
t
he
“
P”
r
of
i
l
e
option. This has two effects on
logprof
:
•
The rule written into the profile is px, which forces the transition
t
o
t
he
chi
l
d’
s
own
pr
of
i
l
e.
•
logprof
constructs a profile for the child and starts building it,
in the same way that it built the parent profile, by ascribing
event
s
f
or
t
he
chi
l
d
pr
ocess
t
o
t
he
chi
l
d’
s
pr
of
i
l
e
and
aski
ng
t
he
logprof
user questions as above.
Finally, we might want to grant the child process
very
powerful access
by
speci
f
yi
ng
“
U”
nconf
i
ned.
Thi
s
wr
i
t
es
“
ux”
i
nt
o
t
he
par
ent
pr
of
i
l
e,
so
that when the child runs, it runs without any Novell AppArmor profile
being applied at all. This means running with no protection, and should
only be used when absolutely required.
1. Run less on a tar ball or an rpm file and it will show you the inventory of these containers.
