Novell LINUX ENTERPRISE DESKTOP 11, Manual

Page: 254 / 450

❼
A link pair rule specifying the source and the target of a link. See Section 21.7.6,
“Link Pair” (page 250) for more information.
❽
The curly braces (
{}
) make this rule apply to the path both with and without the
content enclosed by the braces.
❾
A path entry specifying what areas of the file system the program can access. The
first part of a path entry specifies the absolute path of a file (including regular
expression globbing) and the second part indicates permissible access modes (for
example
r
for read,
w
for write, and
x
for execute). A whitespace of any kind
(spaces or tabs) can precede pathnames or separate the pathname from the access
modes. Spaces between the access mode and the trailing comma is optional. Find
a comprehensive overview of the available access modes in
Section 21.7, “File
Permission Access Modes” (page 249).
❿
This variable expands to a value that can be changed without changing the entire
profile.
11
An owner conditional rule, granting read and write permission on files owned by
the user. Refer to
Section 21.7.7, “Owner Conditional Rules” (page 251) for more
information.
12 This entry defines a transition to the local profile
/usr/bin/foobar
. Find a
comprehensive overview of the available execute modes in Section 21.8, “Execute
Modes” (page 252).
13
A named profile transition to the profile bin_generic located in the global scope.
See
Section 21.8.7, “Named Profile Transitions” (page 254) for details.
14 The local profile
/usr/bin/foobar
is defined in this section.
15
This section references a “hat” subprofile of the application. For more details on
AppArmor's ChangeHat feature, refer to
Chapter 25, Profiling Your Web Applica-
tions Using ChangeHat (page 315).
When a profile is created for a program, the program can access only the files, modes,
and POSIX capabilities specified in the profile. These restrictions are in addition to the
native Linux access controls.
Example: To gain the capability
CAP_CHOWN
, the program must have both access
to
CAP_CHOWN
under conventional Linux access controls (typically, be a
root
-owned
process) and have the capability
chown
in its profile. Similarly, to be able to write to
the file
/foo/bar
the program must have both the correct user ID and mode bits set
240 Security Guide