Novell LINUX ENTERPRISE DESKTOP 11, Manual, Page: 257 / 450

21.2.5 Change rules
AppArmor provides
change_hat
and
change_profile
rules that control domain
transitioning.
change_hat
are specified by defining hats in a profile, while
change_profile
rules refer to another profile and start with the keyword
change_profile
:
change_profile /usr/bin/foobar,
Both
change_hat
and
change_profile
provide for an application directed profile
transition, without having to launch a separate application.
change_profile
provides
a generic one way transition between any of the loaded profiles.
change_hat
provides
for a returnable parent child transition where an application can switch from the parent
profile to the hat profile and if it provides the correct secret key return to the parent
profile at a later time.
change_profile
is best used in situations where an application goes through a
trusted setup phase and then can lower its privilege level. Any resources mapped or
opened during the start-up phase may still be accessible after the profile change, but
the new profile will restrict the opening of new resources, and will even limit some of
the resources opened before the switch. Specifically memory resources will still be
available while capability and file resources (as long as they are not memory mapped)
can be limited.
change_hat
is best used in situations where an applications runs a virtual machine
or an interpreter that does not provide direct access to the applications resources (e.g.
Apache's
mod_php
). Since
change_hat
stores the return secret key in the applica-
tion's memory the phase of reduced privilege should not have direct access to memory.
It is also important that file access is properly separated, since the hat can restrict ac-
cesses to a file handle but does not close it. If an application does buffering and provides
access to the open files with buffering, the accesses to these files may not be seen by
the kernel and hence not restricted by the new profile.
WARNING: Safety of Domain Transitions
The
change_hat
and
change_profile
domain transitions are less secure
than a domain transition done through an exec because they do not affect a
processes memory mappings, nor do they close resources that have already
been opened.
Profile Components and Syntax 243